RubyGems - omniauth-saml - Versions - 2.1.1 - Mend

omniauth-saml 2.1.1

3 security vulnerabilities found in version 2.1.1

omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue

critical severity GHSA-hw46-3hmr-x9xv

Patched versions: ~> 1.10.6, ~> 2.1.3, >= 2.2.3

Summary

There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.

The fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.

Please upgrade the ruby-saml requirement to v1.18.0.

Impact

Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.

omniauth-saml vulnerable to Improper Verification of Cryptographic Signature

critical severity GHSA-cvp8-5r8g-fhvq

Affected versions: >= 2.0.0, < 2.1.2

ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a new release by upgrading ruby-saml to the patched versions v1.17.

omniauth-saml vulnerable to Improper Verification of Cryptographic Signature

critical severity CVE-2024-45409

Patched versions: >= 1.10.5, < 2.0.0, ~> 2.1.2, >= 2.2.1

As a result, omniauth-saml created a new release by upgrading ruby-saml to the patched versions v1.17.

No officially reported memory leakage issues detected.

This gem version does not have any officially reported memory leaked issues.

No license issues detected.

This gem version has a license in the gemspec.

This gem version is available.

This gem version has not been yanked and is still available for usage.