Your message dated Fri, 02 Mar 2018 22:47:19 +0000
with message-id <[email protected]>
and subject line Bug#889286: fixed in simplesamlphp 1.14.11-1+deb9u1
has caused the Debian Bug report #889286,
regarding simplesamlphp: CVE-2017-18121 CVE-2017-18122
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
889286: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889286
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: simplesamlphp
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
the following vulnerabilities were published for simplesamlphp.
CVE-2017-18121[0]:
| The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable
| to a Cross-Site Scripting attack, allowing an attacker to craft links
| that could execute arbitrary JavaScript code on the victim's web
| browser.
CVE-2017-18122[1]:
| A signature-validation bypass issue was discovered in SimpleSAMLphp
| through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will
| regard as valid any unsigned SAML response containing more than one
| signed assertion, provided that the signature of at least one of the
| assertions is valid. Attributes contained in all the assertions
| received will be merged and the entityID of the first assertion
| received will be used, allowing an attacker to impersonate any user of
| any IdP given an assertion signed by the targeted IdP.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2017-18121
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18121
[1] https://security-tracker.debian.org/tracker/CVE-2017-18122
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18122
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: simplesamlphp
Source-Version: 1.14.11-1+deb9u1
We believe that the bug you reported is fixed in the latest version of
simplesamlphp, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thijs Kinkhorst <[email protected]> (supplier of updated simplesamlphp package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Thu, 01 Mar 2018 20:16:49 +0100
Source: simplesamlphp
Binary: simplesamlphp
Architecture: source all
Version: 1.14.11-1+deb9u1
Distribution: stretch-security
Urgency: high
Maintainer: Thijs Kinkhorst <[email protected]>
Changed-By: Thijs Kinkhorst <[email protected]>
Description:
simplesamlphp - Authentication and federation application supporting several
prot
Closes: 889286
Changes:
simplesamlphp (1.14.11-1+deb9u1) stretch-security; urgency=high
.
* Update by the security team for stretch.
CVE-2017-12867 CVE-2017-12869
CVE-2017-12874 CVE-2017-18121 CVE-2017-18122
CVE-2018-6519 CVE-2018-6521 SSPSA-201802-01
(closes: #889286).
Checksums-Sha1:
3543cf43528ed102ddaa806ffceffb1f3887cae4 1583
simplesamlphp_1.14.11-1+deb9u1.dsc
38839fda2266784282fb25249004df190be948ce 2462442
simplesamlphp_1.14.11.orig.tar.gz
d1f847192a4903a0b298b7bc0dae5ca6b49b7b2a 2310032
simplesamlphp_1.14.11-1+deb9u1.debian.tar.xz
f4dc5a8a3a2d2306a17add8bca20f02919e38f19 1635186
simplesamlphp_1.14.11-1+deb9u1_all.deb
87eb77fc7870771a559b83c73bb4483030d5944f 6057
simplesamlphp_1.14.11-1+deb9u1_amd64.buildinfo
Checksums-Sha256:
6be4d2b2e4d33f9fcd1be74b4b10274506e728133483579c0ff0577a9fc16cac 1583
simplesamlphp_1.14.11-1+deb9u1.dsc
4899cae8e66967ad9fbf8dd0efe605b3a7c0f7a7c2c7a09e61470d623ca3a878 2462442
simplesamlphp_1.14.11.orig.tar.gz
7112d71c2e2f77c3c3583b136bedc96f9c543459a7186f29834e39ddea357bf4 2310032
simplesamlphp_1.14.11-1+deb9u1.debian.tar.xz
50ad882b99255dd857302204b5308e415e0e9a7ca6e664ca0a5679f048ec9f36 1635186
simplesamlphp_1.14.11-1+deb9u1_all.deb
ea7d20fcebfd9fbb594fc6b36e8b358cd9acdb0603187198a6eb5db0918d7cd4 6057
simplesamlphp_1.14.11-1+deb9u1_amd64.buildinfo
Files:
5b19aa14972a0e5607bb00224e4f15c0 1583 web extra
simplesamlphp_1.14.11-1+deb9u1.dsc
dde5923967ed0412997bf449898e1c86 2462442 web extra
simplesamlphp_1.14.11.orig.tar.gz
b357025fdb3e6f57db7944196214063d 2310032 web extra
simplesamlphp_1.14.11-1+deb9u1.debian.tar.xz
828dad06bd9503a73aa4eea9abd23d9e 1635186 web extra
simplesamlphp_1.14.11-1+deb9u1_all.deb
190ab21aeac8f5aba7977a324d37024c 6057 web extra
simplesamlphp_1.14.11-1+deb9u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEuBAEBCAAYBQJamFY6ERx0aGlqc0BkZWJpYW4ub3JnAAoJEFb2GnlAHawEdvQI
AI2v8Lq/i+3ioz7vpXpekvG8vocCmGMjxbatJccp5TbzlPtSrg8C6nEMhed/TQck
LKkclwwOEZZjicOwzrC2F5u/g64uTa73E9eUO7gv4ylgz+HoDiOncRvxLGm6QxPV
uiIDHwUQyQ6E/BPF+LcNQXjEpC3d3PtlmU6nS78pPUD0IeOUofhKajQs4wrtpjV+
tMdj53fHOBcBIzoC6z8tGTxx1Y4YaTAWS45X3rPHWu9lQcoQp9nhRJUbnCGvEQHl
+f/l8e8LZZ3GAejBEDkb321B4lhNIztx2LX4uooSR9+ZpesopBlYwmPr7/9hvQJ8
5XNRp2fMpvEcW/bp82tpra8=
=qT73
-----END PGP SIGNATURE-----
--- End Message ---
