CVE-2018-7644

NameCVE-2018-7644
DescriptionThe XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1298-1, DSA-4127-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
simplesamlphp (PTS)stretch (security), stretch1.14.11-1+deb9u2fixed
buster1.16.3-1+deb10u2fixed
buster (security)1.16.3-1+deb10u1fixed
bullseye, sid1.18.8-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
simplesamlphpsourcewheezy1.9.2-1+deb7u3DLA-1298-1
simplesamlphpsourcejessie1.13.1-2+deb8u1DSA-4127-1
simplesamlphpsourcestretch1.14.11-1+deb9u1DSA-4127-1
simplesamlphpsource(unstable)1.15.3-1

Notes

https://simplesamlphp.org/security/201802-01
Fixed by: https://github.com/simplesamlphp/saml2/commit/88a9ae848c4b310b1c53b5700893d890999dd930

Search for package or bug name: Reporting problems