GHSA-pqm6-cgwr-x6pf

Signature validation bypass in XmlSecLibs

At a glance

Published: 2019-11-08 20:06 UTC
Updated: 2024-03-14 05:19 UTC
CVE: CVE-2019-3465
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.

Affected packages

Package	Versions
Packagist · robrichards/xmlseclibs	introduced 3.0.0, fixed 3.0.4
Packagist · robrichards/xmlseclibs	introduced 1.0.0, fixed 2.1.1

References

https://nvd.nist.gov/vuln/detail/CVE-2019-3465 ADVISORY
https://github.com/robrichards/xmlseclibs/commit/0a53d3c3aa87564910cae4ed01416441d3ae0db5 WEB
https://www.tenable.com/security/tns-2019-09 WEB
https://www.debian.org/security/2019/dsa-4560 WEB
https://simplesamlphp.org/security/201911-01 WEB
https://seclists.org/bugtraq/2019/Nov/8 WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBSSRV5Q7JFCYO46A3EN624UZ4KXFQ2M WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCSR3V6LNWJAD37VQB6M2K7P4RQSCVFG WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAWOVYLZKYDCQBLQEJCFAAD3KQTBPHXE WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HBE2SJSXG7J4XYLJ2H6HC2VPPOG2OMUN WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ESKJTWLE7QZBQ3EKMYXKMBQG3JDEJWM6 WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BNFMY5RRLU63P25HEBVDO5KAVI7TX7JV WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBKVDUZ7G5ZOUO4BFJWLNJ6VOKBQJX5U WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AB34ILMJ67CUROBOR6YPKB46VHXLOAJ4 WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7KID7C4AZPYYIZQIPSLANP4R2RQR6YK3 WEB
https://lists.debian.org/debian-lts-announce/2019/11/msg00003.html WEB
https://github.com/FriendsOfPHP/security-advisories/blob/master/robrichards/xmlseclibs/CVE-2019-3465.yaml WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database