Homepage

Improper Verification of Cryptographic Signature Affecting ruby-saml package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-RUBYSAML-9404199
  • published14 Mar 2025
  • disclosed12 Mar 2025
Report a new vulnerability Found a mistake?

Introduced: 12 Mar 2025

NewCVE-2025-25292  (opens in a new tab)
CWE-347  (opens in a new tab)
CWE-436  (opens in a new tab)

How to fix?

There is no fixed version for Debian:12 ruby-saml.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ruby-saml package and not the ruby-saml package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue.

References