GHSA-cvp8-5r8g-fhvq: omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
(updated )
ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a new release by upgrading ruby-saml to the patched versions v1.17.
References
- github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
- github.com/advisories/GHSA-cvp8-5r8g-fhvq
- github.com/omniauth/omniauth-saml
- github.com/omniauth/omniauth-saml/commit/4274e9d57e65f2dcaae4aa3b2accf831494f2ddd
- github.com/omniauth/omniauth-saml/commit/6c681fd082ab3daf271821897a40ab3417382e29
- github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq
- github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/GHSA-cvp8-5r8g-fhvq.yml
Code Behaviors & Features
Detect and mitigate GHSA-cvp8-5r8g-fhvq with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →