漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Unlimited transforms allowed for signed nodes
Vulnerability Description
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Vulnerability Title
Passport-SAML 资源管理错误漏洞
Vulnerability Description
Passport-SAML是Passport的SAML 2.0身份验证提供程序，Node.js 身份验证库。 Passport-SAML 存在资源管理错误漏洞，该漏洞源于在3.1.0版本之前，恶意SAML负载可能需要消耗大量系统资源来处理的转换。攻击者可利用该漏洞导致服务减少或被拒绝。
CVSS Information
N/A
Vulnerability Type
N/A