erroneo.us
Search all guides⌘K

Security Digest · Critical advisory (no CVE assigned)

GHSA-hw46-3hmr-x9xv: omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue

Summary There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.

GitHub-reviewed · critical

Published By erroneo.us Security DeskSeen in the digest for Mar 12, 2025

Should you act?

  • Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with bundle audit check --update.
  • No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

EcosystemPackageVulnerableFirst fixed
RubyGemsomniauth-saml>= 2.2.0, < 2.2.32.2.3
RubyGemsomniauth-saml>= 2.0.0, < 2.1.32.1.3
RubyGemsomniauth-saml< 1.10.61.10.6

Details

Summary There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.

The fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.

Please upgrade the ruby-saml requirement to v1.18.0.

Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.

Sources and references

  1. GitHub Advisory GHSA-hw46-3hmr-x9xv github.com
  2. github.com github.com
  3. github.com github.com
  4. github.com github.com
  5. github.com github.com
  6. github.com github.com
  7. rubygems.org rubygems.org
  8. github.com github.com

Critical RubyGems advisories · Today’s Security Digest