CVE-2024-45409
1 advisory.
RubyGems/ruby-saml CVE-2024-45409: critical 10
SAML authentication bypass via Incorrect XPath selector
Action: Upgrade ruby-saml to 1.12.3 or later.
bundle update ruby-samlAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.12.3 | - |
| 1.13.0 | 1.17.0 | - |
Fixed versions
| 1.12.3 | 1.17.0 |
Sources
- osv: GHSA-jw9c-mfg7-9rx2
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
- https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq
- https://nvd.nist.gov/vuln/detail/CVE-2024-45409
- https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae
- https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7
- https://github.com/omniauth/omniauth-saml/commit/4274e9d57e65f2dcaae4aa3b2accf831494f2ddd
- https://github.com/SAML-Toolkits/ruby-saml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/CVE-2024-45409.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/GHSA-cvp8-5r8g-fhvq.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2024-45409.yml
CVE-2024-45409 · published · modified · JSON