Improper Verification of Cryptographic Signature The advisory has been revoked - it doesn't affect any version of package simplesamlphp (opens in a new tab)

Threat Intelligence

2.99% (87^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-UBUNTU2004-SIMPLESAMLPHP-639297
published10 Sept 2020
disclosed7 Nov 2019

Report a new vulnerability Found a mistake?

Introduced: 7 Nov 2019

CVE-2019-3465 (opens in a new tab) CWE-347 (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:20.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream simplesamlphp package and not the simplesamlphp package as distributed by Ubuntu.

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.