Bug#889286: marked as done (simplesamlphp: CVE-2017-18121 CVE-2017-18122)
Your message dated Sat, 10 Mar 2018 23:18:27 + with message-idand subject line Bug#889286: fixed in simplesamlphp 1.13.1-2+deb8u1 has caused the Debian Bug report #889286, regarding simplesamlphp: CVE-2017-18121 CVE-2017-18122 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 889286: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889286 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: simplesamlphp X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security Hi, the following vulnerabilities were published for simplesamlphp. CVE-2017-18121[0]: | The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable | to a Cross-Site Scripting attack, allowing an attacker to craft links | that could execute arbitrary JavaScript code on the victim's web | browser. CVE-2017-18122[1]: | A signature-validation bypass issue was discovered in SimpleSAMLphp | through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will | regard as valid any unsigned SAML response containing more than one | signed assertion, provided that the signature of at least one of the | assertions is valid. Attributes contained in all the assertions | received will be merged and the entityID of the first assertion | received will be used, allowing an attacker to impersonate any user of | any IdP given an assertion signed by the targeted IdP. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2017-18121 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18121 [1] https://security-tracker.debian.org/tracker/CVE-2017-18122 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18122 Please adjust the affected versions in the BTS as needed. --- End Message --- --- Begin Message --- Source: simplesamlphp Source-Version: 1.13.1-2+deb8u1 We believe that the bug you reported is fixed in the latest version of simplesamlphp, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 889...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Thijs Kinkhorst (supplier of updated simplesamlphp package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Thu, 01 Mar 2018 15:55:01 +0100 Source: simplesamlphp Binary: simplesamlphp Architecture: source all Version: 1.13.1-2+deb8u1 Distribution: jessie-security Urgency: high Maintainer: Thijs Kinkhorst Changed-By: Thijs Kinkhorst Description: simplesamlphp - Authentication and federation application supporting several prot Closes: 889286 Changes: simplesamlphp (1.13.1-2+deb8u1) jessie-security; urgency=high . * Update by the security team for jessie. CVE-2017-12867 CVE-2017-12869 CVE-2017-12873 CVE-2017-12874 CVE-2017-18121 CVE-2017-18122 CVE-2018-6519 CVE-2018-6521 SSPSA-201802-01 (closes: #889286). Checksums-Sha1: 961ac007d548f7e626bc63db99a6d7dc1ba12eb4 1595 simplesamlphp_1.13.1-2+deb8u1.dsc 23d83ed52be2d3ed94ddb31a711df465d42baa71 2303426 simplesamlphp_1.13.1.orig.tar.gz e046f890e95e170ebfc7a5281caf868f2c620498 10676 simplesamlphp_1.13.1-2+deb8u1.debian.tar.xz e3f350a6dbad75581a62513f1fb97fc8c0768ab1 1560998 simplesamlphp_1.13.1-2+deb8u1_all.deb Checksums-Sha256: e825d4ec237e734057c9a5333f7eb5c5cae975f1210548ec8d0af6146470631a 1595 simplesamlphp_1.13.1-2+deb8u1.dsc f8c22ada724b4628257f7415a397f9b0bb2ffd5d036380c5bff6830a33bb613f 2303426 simplesamlphp_1.13.1.orig.tar.gz 15c203180a69b922fdf15b091d8016f3c163b3d14d5c9a2e53620f39861f57a1 10676 simplesamlphp_1.13.1-2+deb8u1.debian.tar.xz cb19a54faba08be248def8ef3d28fcc9b09f29ecb89fb1aef373c464b7b6744e 1560998 simplesamlphp_1.13.1-2+deb8u1_all.deb Files: 52629dac7ae5ecb6c0534154d7e19d3d 1595 web extra simplesamlphp_1.13.1-2+deb8u1.dsc ceda3ee3b084d3bef3d25a99de9a8e80 2303426 web extra simplesamlphp_1.13.1.orig.tar.gz c22d3b3bba59f2ea92b88115986d10ab 10676 web extra simplesamlphp_1.13.1-2+deb8u1.debian.tar.xz
Bug#889286: marked as done (simplesamlphp: CVE-2017-18121 CVE-2017-18122)
Your message dated Fri, 02 Mar 2018 22:47:19 + with message-idand subject line Bug#889286: fixed in simplesamlphp 1.14.11-1+deb9u1 has caused the Debian Bug report #889286, regarding simplesamlphp: CVE-2017-18121 CVE-2017-18122 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 889286: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889286 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: simplesamlphp X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security Hi, the following vulnerabilities were published for simplesamlphp. CVE-2017-18121[0]: | The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable | to a Cross-Site Scripting attack, allowing an attacker to craft links | that could execute arbitrary JavaScript code on the victim's web | browser. CVE-2017-18122[1]: | A signature-validation bypass issue was discovered in SimpleSAMLphp | through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will | regard as valid any unsigned SAML response containing more than one | signed assertion, provided that the signature of at least one of the | assertions is valid. Attributes contained in all the assertions | received will be merged and the entityID of the first assertion | received will be used, allowing an attacker to impersonate any user of | any IdP given an assertion signed by the targeted IdP. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2017-18121 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18121 [1] https://security-tracker.debian.org/tracker/CVE-2017-18122 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18122 Please adjust the affected versions in the BTS as needed. --- End Message --- --- Begin Message --- Source: simplesamlphp Source-Version: 1.14.11-1+deb9u1 We believe that the bug you reported is fixed in the latest version of simplesamlphp, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 889...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Thijs Kinkhorst (supplier of updated simplesamlphp package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Thu, 01 Mar 2018 20:16:49 +0100 Source: simplesamlphp Binary: simplesamlphp Architecture: source all Version: 1.14.11-1+deb9u1 Distribution: stretch-security Urgency: high Maintainer: Thijs Kinkhorst Changed-By: Thijs Kinkhorst Description: simplesamlphp - Authentication and federation application supporting several prot Closes: 889286 Changes: simplesamlphp (1.14.11-1+deb9u1) stretch-security; urgency=high . * Update by the security team for stretch. CVE-2017-12867 CVE-2017-12869 CVE-2017-12874 CVE-2017-18121 CVE-2017-18122 CVE-2018-6519 CVE-2018-6521 SSPSA-201802-01 (closes: #889286). Checksums-Sha1: 3543cf43528ed102ddaa806ffceffb1f3887cae4 1583 simplesamlphp_1.14.11-1+deb9u1.dsc 38839fda2266784282fb25249004df190be948ce 2462442 simplesamlphp_1.14.11.orig.tar.gz d1f847192a4903a0b298b7bc0dae5ca6b49b7b2a 2310032 simplesamlphp_1.14.11-1+deb9u1.debian.tar.xz f4dc5a8a3a2d2306a17add8bca20f02919e38f19 1635186 simplesamlphp_1.14.11-1+deb9u1_all.deb 87eb77fc7870771a559b83c73bb4483030d5944f 6057 simplesamlphp_1.14.11-1+deb9u1_amd64.buildinfo Checksums-Sha256: 6be4d2b2e4d33f9fcd1be74b4b10274506e728133483579c0ff0577a9fc16cac 1583 simplesamlphp_1.14.11-1+deb9u1.dsc 4899cae8e66967ad9fbf8dd0efe605b3a7c0f7a7c2c7a09e61470d623ca3a878 2462442 simplesamlphp_1.14.11.orig.tar.gz 7112d71c2e2f77c3c3583b136bedc96f9c543459a7186f29834e39ddea357bf4 2310032 simplesamlphp_1.14.11-1+deb9u1.debian.tar.xz 50ad882b99255dd857302204b5308e415e0e9a7ca6e664ca0a5679f048ec9f36 1635186 simplesamlphp_1.14.11-1+deb9u1_all.deb ea7d20fcebfd9fbb594fc6b36e8b358cd9acdb0603187198a6eb5db0918d7cd4 6057 simplesamlphp_1.14.11-1+deb9u1_amd64.buildinfo Files: 5b19aa14972a0e5607bb00224e4f15c0 1583 web extra