Publish GHSA-94hm-8q65-rmxm

advisories/github-reviewed/2019/07/GHSA-94hm-8q65-rmxm/GHSA-94hm-8q65-rmxm.json

@@ -1,12 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-94hm-8q65-rmxm",
-  "modified": "2023-01-25T23:09:17Z",
+  "modified": "2023-08-29T14:57:21Z",
   "published": "2019-07-05T21:11:43Z",
   "aliases": [
     "CVE-2017-11430"
   ],
-  "summary": "OmniAuth-SAML Improper Authentication vulnerability",
+  "summary": "OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal",
   "details": "OmniAuth OmniAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.",
   "severity": [
     {
@@ -20,6 +20,11 @@
         "ecosystem": "RubyGems",
         "name": "omniauth-saml"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",
@@ -44,6 +49,14 @@
       "type": "WEB",
       "url": "https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/omniauth/omniauth-saml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/CVE-2017-11430.yml"
+    },
     {
       "type": "WEB",
       "url": "https://www.kb.cert.org/vuls/id/475445"