SB2018030513 - Improper Verification of Cryptographic Signature in SimpleSAMLphp SimpleSAMLphp
Published: March 5, 2018 Updated: July 17, 2020
Security Bulletin ID
SB2018030513
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2018-7711)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP functionality that interprets a -1 error code as a true boolean value.
Remediation
Install update from vendor's website.