In short
- CVE-2021-39171 is a HIGH (CVSS 7.5) vulnerability affecting passport-saml (passport-saml project), passport-saml.
- Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.9% of all vulnerabilities.
- Fix: update to 3.1.0 or later.
Description
Impact
A malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack.
Patches
This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
References
https://github.com/node-saml/passport-saml/pull/595
NVD description
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
More vulnerabilities in passport-saml
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free