p PatchFirst

CVE-2019-3465

CVE-2019-3465

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.

CVSS 8.8 · High · EPSS 3.0% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • rob richards xmlseclibs

    Versions
    • All versions prior to version 3.0.3: Affected

    No fix published

  • simplesamlphp Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.17.6-2

    Update to 1.17.6-2

  • simplesamlphp Debian:14

    Versions
    • 1.10.0-1
    • 1.11.0-1
    • 1.12.0-1
    • 1.12.0~rc1-1
    • 1.12.0~rc2-1
    • 1.13.0-1
    • 1.13.1-1
    • 1.13.1-2
    • 1.13.2-1
    • 1.14.0-1
    • 1.14.1-1
    • 1.14.10-1
    • 1.14.11-1
    • 1.14.15-1
    • 1.14.2-1
    • 1.14.2-2
    • 1.14.3-1
    • 1.14.4-1
    • 1.14.5-1
    • 1.14.6-1
    • 1.14.7-1
    • 1.14.8-1
    • 1.14.9-1
    • 1.15.0-1
    • 1.15.1-1
    • 1.15.2-1
    • 1.15.3-1
    • 1.15.4-1
    • 1.16.0-1
    • 1.16.1-1
    • 1.16.2-1
    • 1.16.3-1
    • 1.17.0-1
    • 1.17.1-1
    • 1.17.2-1
    • 1.17.2-2
    • 1.17.3-1
    • 1.17.4-1
    • 1.17.5-1
    • 1.17.6-1
    • 1.6.0-1
    • 1.6.1-1
    • 1.6.2-1
    • 1.6.3-1
    • 1.6.3-2
    • 1.6.3-3
    • 1.7.0-1
    • 1.7.0-2
    • 1.8.0-1
    • 1.8.1-1
    • 1.8.2-1
    • 1.9.0-1
    • 1.9.0~rc1-1
    • 1.9.0~rc2-1
    • 1.9.1-1
    • 1.9.2-1
    Affected ranges
    • ECOSYSTEM: < 1.17.6-2

    Update to 1.17.6-2

  • robrichards/xmlseclibs Packagist

    Versions
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.0.3
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.0.4

    Update to 3.0.4

  • robrichards/xmlseclibs Packagist

    Versions
    • 1.3.2
    • 1.3.3
    • 1.3.4
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.4.3
    • 2.0.0
    • 2.0.1
    • 2.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 2.1.1

    Update to 2.1.1

  • simplesamlphp Ubuntu:Pro:16.04:LTS

    Versions
    • 1.13.2-1
    • 1.14.0-1
    • 1.14.0-1ubuntu2
    Affected ranges
    • ECOSYSTEM: < 1.14.0-1ubuntu2+esm1

    Update to 1.14.0-1ubuntu2+esm1

  • simplesamlphp Ubuntu:Pro:18.04:LTS

    Versions
    • 1.14.15-1
    • 1.15.0-1
    • 1.15.1-1
    • 1.15.2-1
    • 1.15.3-1
    Affected ranges
    • ECOSYSTEM: < 1.15.3-1ubuntu0.1~esm1

    Update to 1.15.3-1ubuntu0.1~esm1

Original sources

Check your server →