From Salvatore Bonaccorso@21:1/5 to All on Sat Mar 15 21:20:01 2025
Source: simplesamlphp
Version: 1.19.7-1+deb12u1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Hi,
The following vulnerability was published for simplesamlphp.
CVE-2025-27773[0]:
| The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related
| functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is
| a signature confusion attack in the HTTPRedirect binding. An
| attacker with any signed SAMLResponse via the HTTP-Redirect binding
| can cause the application to accept an unsigned message. Versions
| 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.