diff --git a/advisories/github-reviewed/2019/07/GHSA-94hm-8q65-rmxm/GHSA-94hm-8q65-rmxm.json b/advisories/github-reviewed/2019/07/GHSA-94hm-8q65-rmxm/GHSA-94hm-8q65-rmxm.json index a0eb32c03e3..19573413be2 100644 --- a/advisories/github-reviewed/2019/07/GHSA-94hm-8q65-rmxm/GHSA-94hm-8q65-rmxm.json +++ b/advisories/github-reviewed/2019/07/GHSA-94hm-8q65-rmxm/GHSA-94hm-8q65-rmxm.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-94hm-8q65-rmxm", - "modified": "2023-01-25T23:09:17Z", + "modified": "2023-08-29T14:57:21Z", "published": "2019-07-05T21:11:43Z", "aliases": [ "CVE-2017-11430" ], - "summary": "OmniAuth-SAML Improper Authentication vulnerability", + "summary": "OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal", "details": "OmniAuth OmniAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.", "severity": [ { @@ -20,6 +20,11 @@ "ecosystem": "RubyGems", "name": "omniauth-saml" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -44,6 +49,14 @@ "type": "WEB", "url": "https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations" }, + { + "type": "PACKAGE", + "url": "https://github.com/omniauth/omniauth-saml" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/CVE-2017-11430.yml" + }, { "type": "WEB", "url": "https://www.kb.cert.org/vuls/id/475445"