FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-04-18 11:12:36 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
3fcd52b2-4510-11e6-a15f-00248c0c745d	ruby-saml -- XML signature wrapping attack RubySec reports: ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack in the specific scenario where there was a signature that referenced at the same time 2 elements (but past the scheme validator process since 1 of the element was inside the encrypted assertion). ruby-saml users must update to 1.3.0, which implements 3 extra validations to mitigate this kind of attack. Discovery 2016-06-24 Entry 2016-07-08 rubygem-ruby-saml < 1.3.0 CVE-2016-5697 http://rubysec.com/advisories/CVE-2016-5697/ https://github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995

VuXML ID

Description

3fcd52b2-4510-11e6-a15f-00248c0c745d

ruby-saml -- XML signature wrapping attack

RubySec reports:

ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack in the specific scenario where there was a signature that referenced at the same time 2 elements (but past the scheme validator process since 1 of the element was inside the encrypted assertion).

ruby-saml users must update to 1.3.0, which implements 3 extra validations to mitigate this kind of attack.

Discovery 2016-06-24
Entry 2016-07-08
rubygem-ruby-saml

< 1.3.0

CVE-2016-5697
http://rubysec.com/advisories/CVE-2016-5697/
https://github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995