USN-8770-1: SimpleSAMLphp vulnerabilities
Ubuntu patches SimpleSAMLphp signature validation and XXE flaws enabling user impersonation, privilege escalation, and information disclosure.
Ubuntu security notice USN-8770-1 fixes multiple SimpleSAMLphp vulnerabilities. CVE-2019-3465 stems from incorrect cryptographic signature validation in XML messages, allowing an authenticated attacker to impersonate users or gain elevated privileges; it only affected Ubuntu 16.04 LTS and 18.04 LTS. CVE-2024-52596 involves improper handling of external entities when parsing untrusted XML, allowing a remote attacker to obtain sensitive information, and did not affect Ubuntu 24.04 LTS. An additional flaw in signature verification for SAML messages using the HTTP-Redirect binding is also addressed.
- CVE-2019-3465 allows authenticated attackers to impersonate users or escalate privileges
- CVE-2024-52596 XXE flaw lets remote attackers obtain sensitive information
- Older LTS releases most affected; Ubuntu 24.04 LTS unaffected by the XXE issue
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-3465 | Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML… | 8.8 | 3% | ||
| CVE-2024-52596 | SimpleSAMLphp xml-common: When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is… | 8.8 | <1% |
From the original article
It was discovered that SimpleSAMLphp incorrectly validated cryptographic signatures in XML messages. An authenticated attacker could possibly use this issue to impersonate users or gain elevated privileges. This issue only affected Ubuntu 16.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.