The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-of-seconds data in a timestamp.
| Software | From | Fixed in |
|---|---|---|
simplesamlphp / saml2
|
1.0.0 | 1.10.4 |
simplesamlphp / saml2
|
2.0.0 | 2.3.5 |
simplesamlphp / saml2
|
3.0.0 | 3.1.1 |
| debian / debian_linux | 8.0 | 8.0.x |
| debian / debian_linux | 9.0 | 9.0.x |