SimpleSAMLphp Improper Verification of Cryptographic Signature

Impact

The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

Original source description

References

• Security advisory nvd.nist.gov/vuln/detail/CVE-2018-7644
• Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/saml2/CVE-2018-7644.yaml
• Source reference github.com/simplesamlphp/simplesamlphp
• Security advisory simplesamlphp.org/security/201802-01