Rob Richards XmlSecLibs
En bref
- Source
- NVD
- EPSS
- EPSS 2.99 % · centile 87 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- debian
- Statut NVD
- Modified
Rechercher sur…
Description
Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.
Faiblesses (CWE)
- CWE-347 — Vérification incorrecte d'une signature cryptographique
Références
- https://lists.debian.org/debian-lts-announce/2019/11/msg00003.html
- https://seclists.org/bugtraq/2019/Nov/8
- https://www.debian.org/security/2019/dsa-4560
- https://github.com/robrichards/xmlseclibs/commit/0a53d3c3aa87564910cae4ed01416441d3ae0db5
- https://simplesamlphp.org/security/201911-01
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AB34ILMJ67CUROBOR6YPKB46VHXLOAJ4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAWOVYLZKYDCQBLQEJCFAAD3KQTBPHXE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ESKJTWLE7QZBQ3EKMYXKMBQG3JDEJWM6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7KID7C4AZPYYIZQIPSLANP4R2RQR6YK3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XBSSRV5Q7JFCYO46A3EN624UZ4KXFQ2M/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HBE2SJSXG7J4XYLJ2H6HC2VPPOG2OMUN/
- https://www.tenable.com/security/tns-2019-09
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BNFMY5RRLU63P25HEBVDO5KAVI7TX7JV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBKVDUZ7G5ZOUO4BFJWLNJ6VOKBQJX5U/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OCSR3V6LNWJAD37VQB6M2K7P4RQSCVFG/
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-pqm6-cgwr-x6pf — Signature validation bypass in XmlSecLibs
Références européennes
- ENISA EUVD · EUVD-2019-0760
- GCVE · GCVE-0-2019-3465
Avis du CERT-FR
- CERTFR-2020-AVI-011 — Multiples vulnérabilités dans Tenable Tenable.sc · cert.ssi.gouv.fr
- CERTFR-2019-AVI-657 — Multiples vulnérabilités dans Tenable.sc · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:xmlseclibs_project:xmlseclibs:*:*:*:*:*:*:*:*≥ 1.0.0 ≤ 1.4.2cpe:2.3:a:xmlseclibs_project:xmlseclibs:*:*:*:*:*:*:*:*≥ 2.0.0 ≤ 2.1.0cpe:2.3:a:xmlseclibs_project:xmlseclibs:*:*:*:*:*:*:*:*≥ 3.0.0 ≤ 3.0.3cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:*≤ 1.17.6
Produits affectés
| Produit | Versions |
|---|---|
| Rob Richards XmlSecLibs | affected All versions prior to version 3.0.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |