Detections
Analytics

SCA: security update for ruby-saml (GHSA-x4h9-gwv3-r4m4)

critical Tenable Cloud Security Plugin ID 436298

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The ruby-saml library implements the client side of an SAML authorization. Versions up to and including
 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by
 Nokogiri for document transformation, which allows an attacker to execute a Signature Wrapping attack.
 When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather
 than a canonicalized node. ruby-saml then proceeds to compute the DigestValue over this empty string,
 treating it as if canonicalization succeeded. This issue is fixed in version 1.18.0. (CVE-2025-66568)

See Also

https://github.com/advisories/GHSA-x4h9-gwv3-r4m4

Plugin Details

Severity: Critical

ID: 436298

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 12/9/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.62

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2025-66568

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 8

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/8/2025

Vulnerability Publication Date: 12/8/2025

Reference Information

CVE: CVE-2025-66568

cwe: CWE-347