CVE-2023-49087
xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13.
| Software | From | Fixed in |
|---|---|---|
simplesamlphp / xml-security
|
1.6.11 | 1.6.11.x |
|
simplesamlphp / xml-security
|
1.6.11 | 1.6.12 |
|
simplesamlphp / saml2
|
5.0.0-alpha.12 | 5.0.0-alpha.12.x |
|
simplesamlphp / saml2
|
5.0.0-alpha.12 | 5.0.0-alpha.13 |
|
simplesamlphp / saml2
|
5.0.0-alpha12 | 5.0.0-alpha12.x |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime