Digest · Wednesday

Security digest: March 12, 2025

5 critical advisories.

Take stock

RubyGems: 4 critical advisories (graphql, omniauth-saml, ruby-saml). Check with bundle audit check --update.
Go: 1 critical advisory (github.com/cosmos/ibc-go, github.com/cosmos/ibc-go/v8, github.com/cosmos/ibc-go/v2, github.com/cosmos/ibc-go/v3, github.com/cosmos/ibc-go/v4, github.com/cosmos/ibc-go/v5, github.com/cosmos/ibc-go/v6, github.com/cosmos/ibc-go/v7). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: bundle audit check --update

graphql allows remote code execution when loading a crafted GraphQL schema CVE-2025-27407 CVSS 9.0 Critical
graphql >= 2.4.0, < 2.4.13 → fixed in 2.4.13; graphql >= 2.3.0, < 2.3.21 → fixed in 2.3.21; graphql >= 2.0.0, < 2.0.32 → fixed in 2.0.32; +5 more packages
omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue GHSA-hw46-3hmr-x9xv
omniauth-saml >= 2.2.0, < 2.2.3 → fixed in 2.2.3; omniauth-saml >= 2.0.0, < 2.1.3 → fixed in 2.1.3; omniauth-saml < 1.10.6 → fixed in 1.10.6
Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential) CVE-2025-25292 CVSS 9.3 Critical
ruby-saml >= 1.13.0, < 1.18.0 → fixed in 1.18.0; ruby-saml < 1.12.4 → fixed in 1.12.4
Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential) CVE-2025-25291 CVSS 9.3 Critical
ruby-saml < 1.12.4 → fixed in 1.12.4; ruby-saml >= 1.13.0, < 1.18.0 → fixed in 1.18.0

Check: govulncheck ./...

IBC-Go: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt GHSA-4wf3-5qj9-368v
github.com/cosmos/ibc-go < 7.10.0 → fixed in 7.10.0; github.com/cosmos/ibc-go/v8 >= 8.0.0-alpha.1, < 8.7.0 → fixed in 8.7.0; github.com/cosmos/ibc-go/v2 < 7.10.0 → fixed in 7.10.0; +5 more packages