GHSA-hw46-3hmr-x9xv: omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue
(updated )
There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.
The fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.
Please upgrade the ruby-saml requirement to v1.18.0.
References
- github.com/advisories/GHSA-hw46-3hmr-x9xv
- github.com/omniauth/omniauth-saml
- github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec
- github.com/omniauth/omniauth-saml/commit/0d5eaa0d808acb2ac96deadf5c750ac1cf2d92b5
- github.com/omniauth/omniauth-saml/commit/2c8a482801808bbcb0188214bde74680b8018a35
- github.com/omniauth/omniauth-saml/commit/7a348b49083462a566af41a5ae85e9f3af15b985
- github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
- github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/GHSA-hw46-3hmr-x9xv.yml
- rubygems.org/gems/omniauth-saml/versions/2.2.3
Code Behaviors & Features
Detect and mitigate GHSA-hw46-3hmr-x9xv with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →