UBUNTU-CVE-2019-3465

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.

References

Affected packages

Ubuntu:Pro:16.04:LTS / simplesamlphp

Package

Name: simplesamlphp
Purl: pkg:deb/ubuntu/simplesamlphp?arch=source&distro=esm-apps-legacy%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.14.0-1ubuntu2+esm1

Affected versions

1.*

1.13.2-1

1.14.0-1

1.14.0-1ubuntu2

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "simplesamlphp",
            "binary_version": "1.14.0-1ubuntu2+esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-3465.json"

Ubuntu:Pro:18.04:LTS / simplesamlphp

Package

Name: simplesamlphp
Purl: pkg:deb/ubuntu/simplesamlphp?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.15.3-1ubuntu0.1~esm1

Affected versions

1.*

1.14.15-1

1.15.0-1

1.15.1-1

1.15.2-1

1.15.3-1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "simplesamlphp",
            "binary_version": "1.15.3-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-3465.json"