| Package | Affected versions | Patched versions |
|---|---|---|
| ruby-saml | ≥ 1.13.0, < 1.17.0< 1.12.3 | 1.17.01.12.3 |
| gitlab | ≥ 17.0.0, < 17.0.8≥ 17.1.0, < 17.1.8≥ 17.2.0, < 17.2.7≥ 17.3.0, < 17.3.3< 16.11.10 | 17.0.817.1.817.2.717.3.316.11.10 |
| omniauth saml | = 2.0.0= 2.1.0≤ 1.10.3 | |
| ruby-saml | ≥ 1.13.0, < 1.17.0< 1.12.3 | 1.17.01.12.3 |
Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system.
This vulnerability was reported by ahacker1 of SecureSAML ([email protected])
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free