ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.

N/A

密码学签名的验证不恰当

OneLogin ruby-saml 安全漏洞

Onelogin OneLogin ruby-saml是美国Onelogin公司的一款基于Ruby的、用于单点登录（SSO）服务的SAML（安全断言标记语言）库。 ruby-saml 1.12.4和1.18.0之前版本存在安全漏洞，该漏洞源于解析器差异，可能导致认证绕过。

N/A

N/A