omniauth-saml vulnerable to Improper Verification of Cryptographic Signature

CRITICO 10.0GHSA-cvp8-5r8g-fhvq · Published 11/09/2024 · updated 07/08/2026

In breve

GHSA-cvp8-5r8g-fhvq è una vulnerabilità CRITICO (CVSS 10.0) che riguarda omniauth-saml.
Correzione: aggiornare a 2.1.2, 2.2.1, 1.10.5 o successiva.

Package	Affected versions	Patched versions
omniauth-saml RubyGems	`≥ 2.0.0, < 2.1.2≥ 2.2.0, < 2.2.1< 1.10.5`	`2.1.22.2.11.10.5`

ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a new release by upgrading ruby-saml to the patched versions v1.17.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.