From 1fe92fbd69f7eed3e1828f21ff2c7d126cf439db Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 12 Mar 2025 19:44:27 +0000
Subject: [PATCH] Publish GHSA-hw46-3hmr-x9xv

---
 .../GHSA-hw46-3hmr-x9xv.json                  | 108 ++++++++++++++++++
 1 file changed, 108 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/03/GHSA-hw46-3hmr-x9xv/GHSA-hw46-3hmr-x9xv.json

diff --git a/advisories/github-reviewed/2025/03/GHSA-hw46-3hmr-x9xv/GHSA-hw46-3hmr-x9xv.json b/advisories/github-reviewed/2025/03/GHSA-hw46-3hmr-x9xv/GHSA-hw46-3hmr-x9xv.json
new file mode 100644
index 00000000000..c709a568906
--- /dev/null
+++ b/advisories/github-reviewed/2025/03/GHSA-hw46-3hmr-x9xv/GHSA-hw46-3hmr-x9xv.json
@@ -0,0 +1,108 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hw46-3hmr-x9xv",
+  "modified": "2025-03-12T19:42:59Z",
+  "published": "2025-03-12T19:42:58Z",
+  "aliases": [],
+  "summary": "omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue",
+  "details": "### Summary\nThere are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.\n\nThe fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.\n\nPlease [upgrade](https://github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec#L16) the ruby-saml requirement to v1.18.0.\n\n### Impact\nSignature Wrapping Vulnerabilities allows an attacker to impersonate a user.",
+  "severity": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "omniauth-saml"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.2.0"
+            },
+            {
+              "fixed": "2.2.3"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "omniauth-saml"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "2.1.3"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "omniauth-saml"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.10.6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/omniauth/omniauth-saml/commit/0d5eaa0d808acb2ac96deadf5c750ac1cf2d92b5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/omniauth/omniauth-saml/commit/2c8a482801808bbcb0188214bde74680b8018a35"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/omniauth/omniauth-saml/commit/7a348b49083462a566af41a5ae85e9f3af15b985"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/omniauth/omniauth-saml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec#L16"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rubygems.org/gems/omniauth-saml/versions/2.2.3"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-347"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-12T19:42:58Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file