## 3.0.4

CVE-2019-3465 / https://simplesamlphp.org/security/201911-01

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that in SimpleSAMLphp, an implementation of the SAML 2.0 protocol, it was possible to circumvent XML signature verification on SAML messages.

For Debian 8 'Jessie', this problem has been fixed in version 1.13.1-2+deb8u3.

We recommend that you upgrade your simplesamlphp packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

## 1.4.3 (12, Nov 2019)

### Security Improvements :

  - Insure only a single SignedInfo element exists within a     signature during verification. Refs     [CVE-2019-3465](https://nvd.nist.gov/vuln/detail/CVE-201     9-3465).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

## 2.1.1

CVE-2019-3465 / https://simplesamlphp.org/security/201911-01

## 2.1.0

Backports changes from 3.0 branch

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that in SimpleSAMLphp, an implementation of the SAML 2.0 protocol, it was possible to circumvent XML signature verification on SAML messages.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is 5.9.x, 5.10.x, 5.11.x or 5.12.x. It is, therefore, affected by a privilege escalation vulnerability due to incorrect validation of cryptographic signatures in XML messages in the SimpleSAMLPHP third-party component. An authenticated attacker can exploit this to impersonate others or elevate privileges by creating a crafted XML message.

Note that Nessus has not tested for these issues nor the stand-alone patch but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
131044	Fedora 31 : php-robrichards-xmlseclibs3 (2019-9a960c8a98)	Nessus	Fedora Local Security Checks	11/15/2019	4/11/2024	high
130611	Debian DLA-1983-1 : simplesamlphp security update	Nessus	Debian Local Security Checks	11/7/2019	4/15/2024	high
131045	Fedora 29 : php-robrichards-xmlseclibs3 (2019-be01267416)	Nessus	Fedora Local Security Checks	11/15/2019	4/11/2024	high
135419	Fedora 30 : php-robrichards-xmlseclibs1 (2020-1b95d7a131)	Nessus	Fedora Local Security Checks	4/14/2020	3/19/2024	high
135421	Fedora 31 : php-robrichards-xmlseclibs1 (2020-46d0f456a9)	Nessus	Fedora Local Security Checks	4/14/2020	3/19/2024	high
131041	Fedora 31 : php-robrichards-xmlseclibs (2019-73d0fe1d15)	Nessus	Fedora Local Security Checks	11/15/2019	4/11/2024	high
131046	Fedora 30 : php-robrichards-xmlseclibs (2019-dc90bf093b)	Nessus	Fedora Local Security Checks	11/15/2019	4/11/2024	high
131047	Fedora 30 : php-robrichards-xmlseclibs3 (2019-ec8719a21c)	Nessus	Fedora Local Security Checks	11/15/2019	4/11/2024	high
130612	Debian DSA-4560-1 : simplesamlphp - security update	Nessus	Debian Local Security Checks	11/7/2019	4/15/2024	high
131042	Fedora 29 : php-robrichards-xmlseclibs (2019-81f61cdceb)	Nessus	Fedora Local Security Checks	11/15/2019	4/11/2024	high
147896	Tenable SecurityCenter 5.9.x to 5.12.x SimpleSAMLPHP Privilege Escalation (TNS-2020-01)	Nessus	Misc.	3/19/2021	11/7/2023	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high