ruby-saml (RubyGems)
Advisories
14
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.18.1 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update ruby-saml # Gemfile: gem "ruby-saml", ">= 1.18.1"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-x4h9-gwv3-r4m4 Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation |
Critical EPSS 0.25% |
< 1.18.0 | 1.18.0 |
| GHSA-9v8j-x534-2fx3 Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) |
Critical EPSS 0.42% |
< 1.18.0 | 1.18.0 |
| GHSA-rrqh-93c8-j966 Ruby SAML DOS vulnerability with large SAML response |
Medium EPSS 0.46% |
< 1.18.1 | 1.18.1 |
| GHSA-754f-8gm6-c4r2 Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential) |
Critical EPSS 65.09% |
>= 1.13.0, < 1.18.0 | 1.18.0 |
| GHSA-754f-8gm6-c4r2 Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential) |
Critical EPSS 65.09% |
< 1.12.4 | 1.12.4 |
| GHSA-4vc4-m8qh-g8jm Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential) |
Critical EPSS 20.96% |
< 1.12.4 | 1.12.4 |
| GHSA-4vc4-m8qh-g8jm Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential) |
Critical EPSS 20.96% |
>= 1.13.0, < 1.18.0 | 1.18.0 |
| GHSA-92rq-c8cf-prrq Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses |
High EPSS 1.53% |
< 1.12.4 | 1.12.4 |
| GHSA-92rq-c8cf-prrq Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses |
High EPSS 1.53% |
>= 1.13.0, < 1.18.0 | 1.18.0 |
| GHSA-jw9c-mfg7-9rx2 SAML authentication bypass via Incorrect XPath selector |
Critical EPSS 10.68% |
>= 1.13.0, < 1.17.0 | 1.17.0 |
| GHSA-jw9c-mfg7-9rx2 SAML authentication bypass via Incorrect XPath selector |
Critical EPSS 10.68% |
< 1.12.3 | 1.12.3 |
| GHSA-r364-2pj4-pf7f ruby-saml vulnerable to XPath injection |
Critical EPSS 1.33% |
< 1.0.0 | 1.0.0 |
| GHSA-x2fr-v8wf-8wwv Ruby-SAML Improper Authentication vulnerability |
High EPSS 2.46% |
< 1.7.0 | 1.7.0 |
| GHSA-36p7-xjw8-h6f2 Ruby-saml allows attackers to perform XML signature wrapping attacks |
High EPSS 1.21% |
< 1.3.0 | 1.3.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor