PT-2019-6695 · Simplesamlphp · Simplesamlphp

Publicado 2019-11-06 · Atualizado 2022-04-22 · CVE-2011-4625

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions simplesamlphp versions prior to 1.6.3 and versions prior to 1.8.2

Description The issue incorrectly handles XML encryption, potentially allowing remote attackers to decrypt or forge messages.

Recommendations For versions prior to 1.6.3, update to version 1.6.3 or later. For versions prior to 1.8.2, update to version 1.8.2 or later.

Correção

Improper Handling of Exceptional Conditions

Enumeração de Fraquezas

CWE-755

Identificadores relacionados

CVE-2011-4625

DSA-2330-1

GHSA-5FJ7-F8X3-Q2MC

Produtos afetados

Simplesamlphp

Referências · 11

• https://github.com/simplesamlphp/simplesamlphp/blob/b3059c51a915910c6631fb2ee597c0fb6ad9162b/docs/simplesamlphp-changelog-1.x.md?plain=1#L1624 · Nota
• https://github.com/simplesamlphp/simplesamlphp · Nota
• https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202330-1 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-4625 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-4625 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2011-4625 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5fj7-f8x3-q2mc · Aviso do Fabricante
• https://mageni.net/1.3.6.1.4.1.25623.1.0.70545 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4625 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4625 · Aviso do Fabricante
• https://mageni.net/vulnerability/debian-security-advisory-dsa-2330-1-simplesamlphp-70545 · Nota