oss-sec mailing list archives
Re: CVE Request: SimpleSAMLphp: SSPSA 201612-02: Incorrect signature verification
From: <cve-assign () mitre org>
Date: Thu, 15 Dec 2016 12:44:23 -0500
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
SimpleSAMLphp has released (another) update fixing an incorrect signature verification issue (different from SSPSA 201612-01 / CVE-2016-9814). It affects versions of SimpeSAMLphp before 1.14.11. https://simplesamlphp.org/security/201612-02 https://github.com/simplesamlphp/simplesamlphp/commit/a2326d75dd14accaac162dd2cb30aaefcc1f9205
-1 in case an error occurs. PHP allows translating numerical values to boolean implicitly Non-zero equals true.
- if (! $objXMLSecDSig->verify($objKey)) { + if ($objXMLSecDSig->verify($objKey) !== 1) {
Use CVE-2016-9955. - -- CVE Assignment Team M/S M300, 202 Burlington Road, Bedford, MA 01730 USA [ A PGP key is available for encrypted communications at http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJYUtTlAAoJEHb/MwWLVhi27IwP/jG+Zl6XCV9GayTZO3AmZIdC hP3AI4irrLKNtUGifIYuAs7PRrxvqlolx6Frm9u5W7KUTtHZLnVN06lpLdhi5RdZ 7YWrdjEe3Oay5QfE4W6jy+OaTWui8J7w3/nAwUg/O30GqKdY1YTwcWFmDHfR29fG jI5SlZV6CQAzODqlm1dvmJxzvWGwItzKgV6JHK12rs3ODo/qiS0w3Z8lnOlEZyEb c00d9S7y6iYIp1yIXEb2CWnn+CS0tb9JEqKCtwXvlF9/vzfMGCSv2HIXlOUYesPn b8BqdFJn7zSTjaDTIGv2GqEdTZE0gnWkQDuikYg7EF+Eux58wDbCz8eS1dhf8WHq 07vJ5259VJb2JV5Fxlmz9wZpyhWptD6oHMCJZtmS4vk0/WwcLQCoJ0RaMtiW+i1p f7eo+tC3JjFmMmMmsUSXhUGnja9nHs7RtTDRR+S1LdZP2T09otsj53HpuqAgNUyk N68ym2WDCgp6qBmZGZFRbx31Kqtp3IXnfXrgAKOTciRilDI3SEqb1M/jJbX8rw47 qdZomwgSFr1DRX6SZFxbQpxhcTHIT+XxT4m3B9g6b0FF22e6e3IEmotnEYqV0KFi m6UEaYWWfEnKuu/Tz8nHt0Gh2ab8PLvd9aJPNCl3mmULSwVPcrTSnvWRYu3YrCmy hPphYVM98RRx+cSFwh8h =W5cm -----END PGP SIGNATURE-----
Current thread:
- CVE Request: SimpleSAMLphp: SSPSA 201612-02: Incorrect signature verification Salvatore Bonaccorso (Dec 14)
- Re: CVE Request: SimpleSAMLphp: SSPSA 201612-02: Incorrect signature verification cve-assign (Dec 15)