Kurz gesagt
- CVE-2021-39171 ist eine Schwachstelle (HOCH (CVSS 7.5)) in passport-saml (passport-saml project), passport-saml.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.3%, höher als bei 71.0% aller Schwachstellen.
- Abhilfe: auf 3.1.0 oder neuer aktualisieren.
Description
Impact
A malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack.
Patches
This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
References
https://github.com/node-saml/passport-saml/pull/595
NVD description
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free