Security Advisory

Ruby Library Security Update Advisory (CVE-2024-45409)

  • Sep 19 2024

Overview
 

An update has been released to address vulnerabilities in Ruby Library. Users of the affected versions are advised to update to the latest version.

 

Affected Products

 

CVE-2024-45409

  • Ruby-SAML versions: ~ 1.12.2 (inclusive)
  • Ruby-SAML versions: 1.13.0 (inclusive) ~ 1.16.0 (inclusive)

 

 

Resolved Vulnerabilities

 

Ruby-SAML did not properly validate signatures in SAML responses, which could allow an unauthenticated attacker with access to a signed SAML document (by an IdP) to forge SAML responses/assertions with arbitrary content (CVE-2024-45409)

 

Vulnerability Patches

The following product-specific Vulnerability Patches have been made available with the latest update. If you are using an affected version, Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version.

 

CVE-2024-45409

  • Ruby-SAML version: 1.12.3
  • Ruby-SAML version: 1.17.0

 

 

References
 

[1] CVE-2024-45409 Detail

https://nvd.nist.gov/vuln/detail/CVE-2024-45409

[2] SAML authentication bypass via Incorrect XPath selector

https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2

Tags:

Previous Post

Next Post