The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.

Affected: Packagist: simplesamlphp/simplesamlphp

### Background An incorrect check of return values in the signature validation utilities allows an attacker to get invalid signatures accepted as valid by forcing an error during validation.

### Description The `SimpleSAML_XML_Validator` class allows the verification of the XML digital signature of a SAML 1 message with a given key. In particular, the constructor of the class receives an XML node and a key to verify it and throws an exception in case there is an error, either caused by incorrect input or an invalid signature. This method uses the `verify()` method from the `RobRichards\XMLSecDSig` class to verify the signature with the given key, which in turn will end up calling `openssl_verify()` depending on the signature algorithm used.

The `openssl_verify()` function returns `1` when the signature was successfully verified, `0` if it failed to verify with the given key and `-1` in case an error occurs. PHP allows translating numerical values to boolean implicitly, with the following correspondences:

- `0` equals `false` - Non-zero equals `true`

This means that an implicit conversion to _boolean_ of the values returned by `openssl_verify()` will convert an error state, signaled by the value `-1`, to successful verification of the signature (represented by the _boolean_ `true`).

The aforementioned constructor was performing an implicit conversion to boolean of the values returned by the `verify()` method, which subsequently will return the same output as `openssl_ver…

Affected: Ubuntu:Pro:16.04:LTS: simplesamlphp

The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.