PT-2019-6695 · Simplesamlphp · Simplesamlphp

Published 2019-11-06 · Updated 2022-04-22 · CVE-2011-4625

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions simplesamlphp versions prior to 1.6.3 and versions prior to 1.8.2

Description The issue incorrectly handles XML encryption, potentially allowing remote attackers to decrypt or forge messages.

Recommendations For versions prior to 1.6.3, update to version 1.6.3 or later. For versions prior to 1.8.2, update to version 1.8.2 or later.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2011-4625

DSA-2330-1

GHSA-5FJ7-F8X3-Q2MC

Affected Products

Simplesamlphp

References · 11

• https://security-tracker.debian.org/tracker/CVE-2011-4625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4625 · Security Note
• https://osv.dev/vulnerability/CVE-2011-4625 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5fj7-f8x3-q2mc · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4625 · Vendor Advisory
• https://github.com/simplesamlphp/simplesamlphp/blob/b3059c51a915910c6631fb2ee597c0fb6ad9162b/docs/simplesamlphp-changelog-1.x.md?plain=1#L1624 · Note
• https://github.com/simplesamlphp/simplesamlphp · Note
• https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202330-1 · Note
• https://mageni.net/1.3.6.1.4.1.25623.1.0.70545 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4625 · Note
• https://mageni.net/vulnerability/debian-security-advisory-dsa-2330-1-simplesamlphp-70545 · Note