Skip to content

5.0.1

Choose a tag to compare

View all tags
@william-suppo william-suppo released this 29 Jun 20:49
· 4 commits to master since this release
5.0.1
7369d83

Security

  • Reject XML Signature Wrapping (XSW) attacks in SignatureXmlReader (#113)

LightSAML 5.0.0 was vulnerable to an XML Signature Wrapping (XSW) attack
allowing an attacker who has captured one genuine signed assertion to have
LightSAML accept a fully attacker-authored assertion as IdP-signed, leading
to authentication bypass and privilege escalation.

The fix enforces two invariants before signature validation: the ds:Signature
parent element must carry the ID referenced by the fragment URI, and that ID
must be unique in the document.

Full Changelog: 5.0.0...5.0.1

Assets 2
Loading