SimpleSAMLphp InfoCard module Incorrect signature verification

ALTO 7.5CVE-2017-12874 · GHSA-fj28-869x-vv5g · Published 01/09/2017 · updated 17/06/2026

Em resumo

CVE-2017-12874 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta simplesamlphp/simplesamlphp-module-infocard, infocard module (simplesamlphp).
Chance de exploração nos próximos 30 dias (EPSS): 1.3%, maior que 69.9% das vulnerabilidades.
Correção: atualize para 1.0.1 ou posterior.

Package	Affected versions	Patched versions
simplesamlphp/simplesamlphp-module-infocard Packagist	`< 1.0.1`	`1.0.1`
infocard module simplesamlphp	`= 1.0`	No fix yet

Description

The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.

NVD description

The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.

References

nvd.nist.gov/vuln/detail/CVE-2017-12874 · ADVISORY
simplesamlphp/simplesamlphp-module-infocard commit 63b84cc · WEB
FriendsOfPHP/security-advisories · WEB
simplesamlphp/simplesamlphp · PACKAGE
lists.debian.org/debian-lts-announce/2017/12/msg00007.html · WEB
simplesamlphp.org/security/201612-03 · WEB
debian.org/security/2018/dsa-4127 · WEB

Mais vulnerabilidades de simplesamlphp/simplesamlphp-module-infocard

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

simplesamlphp/simplesamlphp-module-infocard

Packagist

< 1.0.1

1.0.1

infocard module

simplesamlphp

= 1.0

No fix yet

Description

The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.

NVD description

The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.