Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
    (CVE-2016-5697)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7309-1 advisory.

    It was discovered that Ruby SAML did not properly validate SAML responses. An unauthenticated attacker     could use this vulnerability to log in as an

    abitrary user. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-5697)

    It was discovered that Ruby SAML incorrectly utilized the results of XML DOM traversal and     canonicalization APIs. An unauthenticated attacker could use this vulnerability to log in as an abitrary     user. This issue only

    affected Ubuntu 16.04 LTS. (CVE-2017-11428)

    It was discovered that Ruby SAML did not properly verify the signature of the SAML Response, allowing     multiple elements with the same ID. An

    unauthenticated attacker could use this vulnerability to log in as an

    abitrary user. (CVE-2024-45409)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

RubySec reports :

ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack in the specific scenario where there was a signature that referenced at the same time 2 elements (but past the scheme validator process since 1 of the element was inside the encrypted assertion).

ruby-saml users must update to 1.3.0, which implements 3 extra validations to mitigate this kind of attack.

ID	Name	Product	Family	Severity
421879	SCA: security update for ruby-saml (GHSA-36p7-xjw8-h6f2)	Tenable Cloud Security	SCA Checks	high
421879	SCA: security update for ruby-saml (GHSA-36p7-xjw8-h6f2)	Tenable Self-Hosted Container Security	SCA Checks	high
216932	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Ruby SAML vulnerabilities (USN-7309-1)	Nessus	Ubuntu Local Security Checks	critical
92006	FreeBSD : ruby-saml -- XML signature wrapping attack (3fcd52b2-4510-11e6-a15f-00248c0c745d)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-5697

high

Tenable Plugins

high

high

critical

high