En bref
- CVE-2016-9814 est une vulnérabilité CRITIQUE (CVSS 9.1) touchant simplesamlphp/saml2, saml2 (simplesamlphp), simplesamlphp (simplesamlphp).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.4%, plus élevée que 84.1% des vulnérabilités.
- Correctif : mettre à jour vers 1.10.3, 1.9.1, 2.3.3, 1.8.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| simplesamlphp/saml2 Packagist | ≥ 1.10, < 1.10.3≥ 1.9.0, < 1.9.1≥ 2.0, < 2.3.3< 1.8.1
| 1.10.31.9.12.3.31.8.1
|
| saml2 | = 1.10= 1.10.1= 1.10.2= 2.0.0= 2.0.1= 2.1= 2.2= 2.3= 2.3.1= 2.3.2≤ 1.9
| No fix yet |
| simplesamlphp | = 1.10≤ 1.14.9
| No fix yet |
Description
The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.
NVD description
The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.
Autres vulnérabilités de simplesamlphp/saml2
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free