Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 9 Jul 2015 02:48:35 -0700
From: Reed Loden <reed@...dloden.com>
To: oss-security@...ts.openwall.com, 
	Assign a CVE Identifier <cve-assign@...re.org>
Subject: CVE request: XEE in ruby gem ruby-saml <1.0.0

Noticed this when reading changelog entries... I'm weird like that.

https://github.com/onelogin/ruby-saml/pull/247

https://github.com/onelogin/ruby-saml/commit/a2e5318530701bf14528c5b3b51c880b3499a75d

"Avoid entity expansion (XEE attacks)"

Release notes for ruby-saml v1.0.0
https://github.com/onelogin/ruby-saml/releases/tag/v1.0.0

(I wonder if the "Fix xpath injection on xml_security.rb" fix is a vuln as
well)

~reed

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ