p PatchFirst

CVE-2017-12868

CVE-2017-12868

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.

CVSS 9.8 · Critical · EPSS 2.1% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • simplesamlphp Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.14.15-1

    Update to 1.14.15-1

  • simplesamlphp Debian:14

    Versions
    • 1.10.0-1
    • 1.11.0-1
    • 1.12.0-1
    • 1.12.0~rc1-1
    • 1.12.0~rc2-1
    • 1.13.0-1
    • 1.13.1-1
    • 1.13.1-2
    • 1.13.2-1
    • 1.14.0-1
    • 1.14.1-1
    • 1.14.10-1
    • 1.14.11-1
    • 1.14.2-1
    • 1.14.2-2
    • 1.14.3-1
    • 1.14.4-1
    • 1.14.5-1
    • 1.14.6-1
    • 1.14.7-1
    • 1.14.8-1
    • 1.14.9-1
    • 1.6.0-1
    • 1.6.1-1
    • 1.6.2-1
    • 1.6.3-1
    • 1.6.3-2
    • 1.6.3-3
    • 1.7.0-1
    • 1.7.0-2
    • 1.8.0-1
    • 1.8.1-1
    • 1.8.2-1
    • 1.9.0-1
    • 1.9.0~rc1-1
    • 1.9.0~rc2-1
    • 1.9.1-1
    • 1.9.2-1
    Affected ranges
    • ECOSYSTEM: < 1.14.15-1

    Update to 1.14.15-1

  • simplesamlphp/simplesamlphp Packagist

    Versions
    • v1.14.12
    • v1.14.13
    Affected ranges
    • ECOSYSTEM: ≥ 1.14.12, < 1.14.14

    Update to 1.14.14

  • simplesamlphp Ubuntu:Pro:16.04:LTS

    Versions
    • 1.13.2-1
    • 1.14.0-1
    • 1.14.0-1ubuntu2
    • 1.14.0-1ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →