Your message dated Sat, 10 Mar 2018 23:18:27 +0000
with message-id <[email protected]>
and subject line Bug#889286: fixed in simplesamlphp 1.13.1-2+deb8u1
has caused the Debian Bug report #889286,
regarding simplesamlphp: CVE-2017-18121 CVE-2017-18122
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
889286: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889286
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: simplesamlphp
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
the following vulnerabilities were published for simplesamlphp.
CVE-2017-18121[0]:
| The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable
| to a Cross-Site Scripting attack, allowing an attacker to craft links
| that could execute arbitrary JavaScript code on the victim's web
| browser.
CVE-2017-18122[1]:
| A signature-validation bypass issue was discovered in SimpleSAMLphp
| through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will
| regard as valid any unsigned SAML response containing more than one
| signed assertion, provided that the signature of at least one of the
| assertions is valid. Attributes contained in all the assertions
| received will be merged and the entityID of the first assertion
| received will be used, allowing an attacker to impersonate any user of
| any IdP given an assertion signed by the targeted IdP.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2017-18121
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18121
[1] https://security-tracker.debian.org/tracker/CVE-2017-18122
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18122
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: simplesamlphp
Source-Version: 1.13.1-2+deb8u1
We believe that the bug you reported is fixed in the latest version of
simplesamlphp, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thijs Kinkhorst <[email protected]> (supplier of updated simplesamlphp package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Thu, 01 Mar 2018 15:55:01 +0100
Source: simplesamlphp
Binary: simplesamlphp
Architecture: source all
Version: 1.13.1-2+deb8u1
Distribution: jessie-security
Urgency: high
Maintainer: Thijs Kinkhorst <[email protected]>
Changed-By: Thijs Kinkhorst <[email protected]>
Description:
simplesamlphp - Authentication and federation application supporting several
prot
Closes: 889286
Changes:
simplesamlphp (1.13.1-2+deb8u1) jessie-security; urgency=high
.
* Update by the security team for jessie.
CVE-2017-12867 CVE-2017-12869 CVE-2017-12873
CVE-2017-12874 CVE-2017-18121 CVE-2017-18122
CVE-2018-6519 CVE-2018-6521 SSPSA-201802-01
(closes: #889286).
Checksums-Sha1:
961ac007d548f7e626bc63db99a6d7dc1ba12eb4 1595 simplesamlphp_1.13.1-2+deb8u1.dsc
23d83ed52be2d3ed94ddb31a711df465d42baa71 2303426
simplesamlphp_1.13.1.orig.tar.gz
e046f890e95e170ebfc7a5281caf868f2c620498 10676
simplesamlphp_1.13.1-2+deb8u1.debian.tar.xz
e3f350a6dbad75581a62513f1fb97fc8c0768ab1 1560998
simplesamlphp_1.13.1-2+deb8u1_all.deb
Checksums-Sha256:
e825d4ec237e734057c9a5333f7eb5c5cae975f1210548ec8d0af6146470631a 1595
simplesamlphp_1.13.1-2+deb8u1.dsc
f8c22ada724b4628257f7415a397f9b0bb2ffd5d036380c5bff6830a33bb613f 2303426
simplesamlphp_1.13.1.orig.tar.gz
15c203180a69b922fdf15b091d8016f3c163b3d14d5c9a2e53620f39861f57a1 10676
simplesamlphp_1.13.1-2+deb8u1.debian.tar.xz
cb19a54faba08be248def8ef3d28fcc9b09f29ecb89fb1aef373c464b7b6744e 1560998
simplesamlphp_1.13.1-2+deb8u1_all.deb
Files:
52629dac7ae5ecb6c0534154d7e19d3d 1595 web extra
simplesamlphp_1.13.1-2+deb8u1.dsc
ceda3ee3b084d3bef3d25a99de9a8e80 2303426 web extra
simplesamlphp_1.13.1.orig.tar.gz
c22d3b3bba59f2ea92b88115986d10ab 10676 web extra
simplesamlphp_1.13.1-2+deb8u1.debian.tar.xz
1ee42833313099cd322dc7ac97949507 1560998 web extra
simplesamlphp_1.13.1-2+deb8u1_all.deb
-----BEGIN PGP SIGNATURE-----
iQEuBAEBCAAYBQJamE72ERx0aGlqc0BkZWJpYW4ub3JnAAoJEFb2GnlAHawEIm0I
AKwO60yVJnLlKX+PG7FgrMYw286brUmMUHP6MqKg0vXYtPc4CD5dfOtZXrOpb2Xo
lz9sScHxJDPMR2TvXm/qY1neYRk1v2geA+yYTqklQDD05jFb6WLe5oOtr/pwFON0
d5SSHeQedo0gFjkEhxRCtTOKysLXqxP/vsnTSSpAr7DrKF1WNdQYIbcCRSVAUPhd
egF1kADkblHKaG/lDuvG3AJZHYgKU2py0RpS3zuqevnPa7oyCyZHS3SrW0A3DtgY
3M9KmkZ/RcNm7qdj6sR/fgX5gXYbnOsOQ8AUuk+Hus1/ODqwf92gTlrf9l19u8Cq
uXKs+UB6FRrCNmZPvh6D0uc=
=lejY
-----END PGP SIGNATURE-----
--- End Message ---
