CVE-2023-49087
published 2023-11-30CVE-2023-49087: xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.19%
9.1th percentile
xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| simplesamlphp | saml2 | — | — |
| simplesamlphp | saml2 | >= 5.0.0-alpha.12 < 5.0.0-alpha.13 | 5.0.0-alpha.13 |
| simplesamlphp | xml-security | — | — |
| simplesamlphp | xml-security | — | — |
| simplesamlphp | xml-security | — | — |
| simplesamlphp | xml-security | >= 1.6.11 < 1.6.12 | 1.6.12 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Validation of SignedInfo
ghsa·2023-11-28
CVE-2023-49087 [HIGH] CWE-345 Validation of SignedInfo
Validation of SignedInfo
Validation of an XML Signature requires verification that the hash value of the related XML-document (after any optional transformations and/or normalizations) matches a specific DigestValue-value, but also that the cryptografic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key.
Within the simpleSAMLphp/xml-security library (https://github.com/simplesamlphp/xml-security), the hash is being validated using SignedElementTrait::validateReference, and the signature is being verified in SignedElementTrait::verifyInternal
https://github.com/simplesamlphp/xml-security/blob/master/src/XML/SignedElementTrait.php:
What stands out is that the signature is being calculated over the canonical version of the S
OSV
Validation of SignedInfo
osv·2023-11-28
CVE-2023-49087 [HIGH] Validation of SignedInfo
Validation of SignedInfo
Validation of an XML Signature requires verification that the hash value of the related XML-document (after any optional transformations and/or normalizations) matches a specific DigestValue-value, but also that the cryptografic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key.
Within the simpleSAMLphp/xml-security library (https://github.com/simplesamlphp/xml-security), the hash is being validated using SignedElementTrait::validateReference, and the signature is being verified in SignedElementTrait::verifyInternal
https://github.com/simplesamlphp/xml-security/blob/master/src/XML/SignedElementTrait.php:
What stands out is that the signature is being calculated over the canonical version of the S
Red Hat
xml-security: insufficient verification of data can lead to signature forging
vendor_redhat·2023-11-30·CVSS 6.8
CVE-2023-49087 [MEDIUM] CWE-345 xml-security: insufficient verification of data can lead to signature forging
xml-security: insufficient verification of data can lead to signature forging
xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13.
A flaw was found in xml-security due to insufficient verification of data authenticity. If an attacke
No detection rules found.
No public exploits indexed.
https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b5122317287581https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6rhttps://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b5122317287581https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6r
2023-11-30
Published