Security Digest · Critical advisory (no CVE assigned)
GHSA-cvp8-5r8g-fhvq: omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in
CVSS 9.9 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
bundle audit check --update. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| RubyGems | omniauth-saml | >= 2.0.0, < 2.1.2 | 2.1.2 |
| RubyGems | omniauth-saml | < 1.10.5 | 1.10.5 |
| RubyGems | omniauth-saml | >= 2.2.0, < 2.2.1 | 2.2.1 |
Details
ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in
CVSS: 9.9 (v4.0) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Sources and references
- GitHub Advisory GHSA-cvp8-5r8g-fhvq github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com