Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Patches Users should upgrade to node-saml v4.0.0-beta5 or newer. Workarounds Disable SAML authentication. References Are there any links users can visit to find out more? For more information If you have any questions or comments about this advisory: Open a discussion in the node-saml repo Credits Felix Wilhelm of Google Project Zero
Recommended action: Upgrade to 4.0.0-beta.5 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Patches Users should upgrade to passport-saml 3.2.2 or newer. The issue was also present in the beta releases of node-saml before v4.0.0-beta.5. Workarounds Disable SAML authentication. References Are there any links users can visit to find out more? For more information If you have any questions or comments about this advisory: Open a discussion in the node-saml repo Credits Felix Wilhelm of Google Project Zero
Recommended action: Upgrade to 4.0.0-beta.5 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.