CVE-2017-12868

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2017-12868
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-12868.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2017-12868
Aliases
Related
Published
2017-09-01T13:29:00Z
Modified
2024-10-12T02:31:39.404283Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.

References

Affected packages

Debian:11 / simplesamlphp

Package

Name
simplesamlphp
Purl
pkg:deb/debian/simplesamlphp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.14.15-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / simplesamlphp

Package

Name
simplesamlphp
Purl
pkg:deb/debian/simplesamlphp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.14.15-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / simplesamlphp

Package

Name
simplesamlphp
Purl
pkg:deb/debian/simplesamlphp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.14.15-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/simplesamlphp/simplesamlphp

Affected ranges

Type
GIT
Repo
https://github.com/simplesamlphp/simplesamlphp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4bc629658e7b7d17c9ac3fe0da7dc5df71f1b85e

Affected versions

v1.*

v1.12.0