p PatchFirst

CVE-2018-7711

CVE-2018-7711

This page contains facts from public vulnerability sources. Check the original advisory before updating.

HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP functionality that interprets a -1 error code as a true boolean value.

CVSS 8.1 · High · EPSS 1.2% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • simplesamlphp Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.15.4-1

    Update to 1.15.4-1

  • simplesamlphp Debian:14

    Versions
    • 1.10.0-1
    • 1.11.0-1
    • 1.12.0-1
    • 1.12.0~rc1-1
    • 1.12.0~rc2-1
    • 1.13.0-1
    • 1.13.1-1
    • 1.13.1-2
    • 1.13.2-1
    • 1.14.0-1
    • 1.14.1-1
    • 1.14.10-1
    • 1.14.11-1
    • 1.14.15-1
    • 1.14.2-1
    • 1.14.2-2
    • 1.14.3-1
    • 1.14.4-1
    • 1.14.5-1
    • 1.14.6-1
    • 1.14.7-1
    • 1.14.8-1
    • 1.14.9-1
    • 1.15.0-1
    • 1.15.1-1
    • 1.15.2-1
    • 1.15.3-1
    • 1.6.0-1
    • 1.6.1-1
    • 1.6.2-1
    • 1.6.3-1
    • 1.6.3-2
    • 1.6.3-3
    • 1.7.0-1
    • 1.7.0-2
    • 1.8.0-1
    • 1.8.1-1
    • 1.8.2-1
    • 1.9.0-1
    • 1.9.0~rc1-1
    • 1.9.0~rc2-1
    • 1.9.1-1
    • 1.9.2-1
    Affected ranges
    • ECOSYSTEM: < 1.15.4-1

    Update to 1.15.4-1

  • simplesamlphp/saml2 Packagist

    Versions
    • v0.1.0
    • v0.1.0-alpha
    • v0.3.0
    • v0.4.0
    • v0.4.1
    • v0.4.2
    • v0.5.0
    • v0.6.0
    • v0.6.1
    • v0.6.2
    • v0.6.3
    • v0.6.4
    • v0.7.0
    • v0.7.1
    • v0.8.0
    • v0.8.1
    • v1.0.0
    • v1.1.0
    • v1.10
    • v1.10.1
    • v1.10.2
    • v1.10.3
    • v1.10.4
    • v1.10.5
    • v1.2.0
    • v1.3.0
    • v1.3.1
    • v1.3.2
    • v1.4.0
    • v1.5.0
    • v1.5.1
    • v1.5.2
    • v1.5.3
    • v1.5.4
    • v1.6.0
    • v1.6.1
    • v1.7.0
    • v1.7.1
    • v1.7.2
    • v1.8
    • v1.8.1
    • v1.8.2
    • v1.9
    • v1.9.1
    • v1.9.2
    Affected ranges
    • ECOSYSTEM: < 1.10.6

    Update to 1.10.6

  • simplesamlphp/saml2 Packagist

    Versions
    • v2.0.0
    • v2.0.1
    • v2.1
    • v2.2
    • v2.3
    • v2.3.1
    • v2.3.2
    • v2.3.3
    • v2.3.4
    • v2.3.5
    • v2.3.6
    • v2.3.7
    Affected ranges
    • ECOSYSTEM: ≥ 2.0, < 2.3.8

    Update to 2.3.8

  • simplesamlphp/saml2 Packagist

    Versions
    • v3.0.0
    • v3.0.1
    • v3.0.2
    • v3.0.3
    • v3.1.0
    • v3.1.1
    • v3.1.2
    • v3.1.3
    Affected ranges
    • ECOSYSTEM: ≥ 3.0, < 3.1.4

    Update to 3.1.4

  • simplesamlphp Ubuntu:Pro:16.04:LTS

    Versions
    • 1.13.2-1
    • 1.14.0-1
    • 1.14.0-1ubuntu2
    • 1.14.0-1ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • simplesamlphp Ubuntu:Pro:18.04:LTS

    Versions
    • 1.14.15-1
    • 1.15.0-1
    • 1.15.1-1
    • 1.15.2-1
    • 1.15.3-1
    • 1.15.3-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →