CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

CVE details

CVE-2024-45409

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.

Score
10.0 critical
Published
2024-09-10
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
devel/rubygem-gitlab_metarubygem-gitlab_meta7.0unaddressedruby@FreeBSD.org

VuXML

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>rubygem-gitlab_meta</name>
	<range><lt>16.11.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Ruby SAML library is for implementing the client side of a SAML
	authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not
	properly verify the signature of the SAML Response. An unauthenticated
	attacker with access to any signed saml document (by the IdP) can thus
	forge a SAML Response/Assertion with arbitrary contents. This would
	allow the attacker to log in as arbitrary user within the vulnerable
	system. This vulnerability is fixed in 1.17.0 and 1.12.3.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2024-45409</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2024-45409</url>
    </references>
    <dates>
      <discovery>2024-09-10</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>