CVE-2018-6519: SimpleSAMLphp SAML2 library Regular Expression Denial of Service vulnerability
Summary
CVE-2018-6519: SimpleSAMLphp SAML2 library Regular Expression Denial of Service vulnerability. Affects simplesamlphp/saml2 across 3 version ranges.
< 1.10.4
>= 2.0, < 2.3.5
>= 3.0, < 3.1.1
Fixed in 1.10.4, 2.3.5 or 3.1.1, depending on the release line you run. How to fix ↓
Also tracked for
- simplesamlphp · Debian:11
The same CVE-2018-6519 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SimpleSAMLphp is an open-source PHP library that provides support for the SAML 2.0 protocol. It is widely used for implementing Single Sign-On (SSO) solutions in PHP applications. The library allows applications to act as Service Providers (SP) or Identity Providers (IdP) in SAML-based authentication flows. This vulnerability affects the SAML2 library in SimpleSAMLphp versions before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1. The library is responsible for handling SAML 2.0 messages and processing various components of the SAML protocol.
Vulnerability Detail
The vulnerability identified as CVE-2018-6519 is a Regular Expression Denial of Service (ReDoS) vulnerability that affects the SAML2 library in SimpleSAMLphp. It occurs when processing fraction-of-seconds data in a timestamp. An attacker can exploit this vulnerability by sending a specially crafted SAML message containing a timestamp with a large number of fraction-of-seconds digits. When the library attempts to validate and parse the timestamp, the regular expression used for parsing can enter into an exponential time complexity, leading to a denial of service condition. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.10.41.10.4composer require simplesamlphp/saml2:1.10.4 -
>= 2.0, < 2.3.52.3.5composer require simplesamlphp/saml2:2.3.5 -
>= 3.0, < 3.1.13.1.1composer require simplesamlphp/saml2:3.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the SimpleSAMLphp library to the fixed versions as soon as possible.
Conclusion
The SAML2 library in SimpleSAMLphp is vulnerable to a Regular Expression Denial of Service (ReDoS) issue when processing fraction-of-seconds data in timestamps. This vulnerability can be exploited by an attacker to cause a denial of service condition in applications using SimpleSAMLphp. To mitigate the risk, it is crucial to update the library to the fixed versions (1.10.4, 2.3.5, or 3.1.1). For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simplesamlphp/saml2 →
FAQ
SimpleSAMLphp is an open-source PHP library used for implementing SAML-based Single Sign-On (SSO) solutions in PHP applications.
This vulnerability can lead to a denial of service condition in applications using SimpleSAMLphp. An attacker can exploit the vulnerability by sending a specially crafted SAML message, causing the library to consume excessive computational resources and potentially impacting the availability of the affected application.
To fix this vulnerability, update SimpleSAMLphp to version 1.10.4, 2.3.5, or 3.1.1, depending on the version being used. These versions include a fix for the vulnerability and mitigate the risk of exploitation.
No, there is no known workaround for this vulnerability. It is recommended to update the SimpleSAMLphp library to the fixed versions.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp/saml2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
