PT-2018-17607 · Simplesamlphp · Simplesamlphp Saml2 Library

Publicado 2018-02-02 · Atualizado 2022-05-14 · CVE-2018-6519

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp SAML2 library versions prior to 1.10.4 SimpleSAMLphp SAML2 library versions 2.x prior to 2.3.5 SimpleSAMLphp SAML2 library versions 3.x prior to 3.1.1

Description The issue is related to a Regular Expression Denial of Service vulnerability. This vulnerability affects the processing of fraction-of-seconds data in a timestamp.

Recommendations For versions prior to 1.10.4, update to version 1.10.4 or later. For versions 2.x prior to 2.3.5, update to version 2.3.5 or later. For versions 3.x prior to 3.1.1, update to version 3.1.1 or later.

Exploit

Correção

DoS

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2018-6519

DSA-4127-1

GHSA-HHM8-2J4G-MPGG

Produtos afetados

Simplesamlphp Saml2 Library

Referências · 28

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/saml2/CVE-2018-6519.yaml · Exploit
• https://github.com/simplesamlphp/simplesamlphp · Nota
• https://github.com/simplesamlphp/saml2/commit/726404bf7b4085a9eb9c9a869af1ecc146bd8f6d · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-6519 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18121 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12867 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-4127-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7644 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6521 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-6519 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-6519 · Aviso do Fabricante
• https://simplesamlphp.org/security/201801-01 · Aviso do Fabricante
• https://packages.debian.org/src:simplesamlphp · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12874 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12873 · Nota de Segurança