CVE-2017-11428

Name	CVE-2017-11428
Description	OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	892865

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ruby-saml (PTS)	buster	1.7.2-1	fixed
	bullseye	1.11.0-1	fixed
	bookworm	1.13.0-1	fixed
	sid, trixie	1.15.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ruby-saml	source	(unstable)	1.7.2-1			892865

Notes

[stretch] - ruby-saml <no-dsa> (Minor issue)
fixed in 1.7.0
https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
https://www.kb.cert.org/vuls/id/475445
https://github.com/onelogin/ruby-saml/commit/048a544730930f86e46804387a6b6fad50d8176f