| Package | Affected versions | Patched versions |
|---|---|---|
| simplesamlphp/saml2 | ≥ 1.10, < 1.10.3≥ 1.9.0, < 1.9.1≥ 2.0, < 2.3.3< 1.8.1 | 1.10.31.9.12.3.31.8.1 |
| saml2 | = 1.10= 1.10.1= 1.10.2= 2.0.0= 2.0.1= 2.1= 2.2= 2.3= 2.3.1= 2.3.2≤ 1.9 | |
| simplesamlphp | = 1.10≤ 1.14.9 |
The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free