https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:44:29 +0000 https://cve.radiocsirt.org/vuln/cnvd-2017-31287 cnvd-2017-31287 https://cve.radiocsirt.org/vuln/cnvd-2017-31287 https://cve.radiocsirt.org/vuln/euvd-2026-77346 EUVD-2026-77346 https://cve.radiocsirt.org/vuln/euvd-2026-77346 https://cve.radiocsirt.org/vuln/fkie_cve-2017-12873 <p>SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.</p> <p>SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-12873 https://cve.radiocsirt.org/vuln/ghsa-gp2m-7cfp-h6gf <p><strong>Affected:</strong> Packagist: simplesamlphp/simplesamlphp</p> <p>### Background When a SimpleSAMLphp Identity Provider is misconfigured, a bug in the software when trying to build a persistent `NameID` to univocally identify the authenticating subject could cause different users to get the same identifier generated, depending on the attributes available for them right after authentication.</p> <p>Please note that even though this is possible thanks to a bug, **an IdP must be misconfigured** to release persistent `NameID`s even if it is not properly configured to generate them based on the specifics of the deployment.</p> <p>### Description Persistent `NameID`s will typically be sent as part of the `Subject` element of a SAML assertion, or as the contents of the `eduPersonTargetedID` attribute. Here is an example of such a `NameID`:</p> <p>&lt;NameID Format=“urn:oasis:names:tc:SAML:2.0:nameid-format:persistent“&gt; zbonsm0Yn9Gnw14uQEEPr6AO7d+IvxwCQN3t+o24jYs= &lt;/NameID&gt;</p> <p>Some service providers will use this information to identify a user across sessions because a persistent `NameID` will never change for a given user. This could lead to different users accessing the same account in those service providers.</p> <p>In order to be affected by this issue, the following circumstances must concur:</p> <p>- SimpleSAMLphp acts as an identity provider. - The service provider asking for authentication requests a persistent `NameID`. - No `saml:PersistentNameID` authentication processing filter is configured (neither for the whole IdP, nor for a given SP). - No `simplesa…</p> <p><strong>Affected:</strong> Packagist: simplesamlphp/simplesamlphp</p> <p>### Background When a SimpleSAMLphp Identity Provider is misconfigured, a bug in the software when trying to build a persistent `NameID` to univocally identify the authenticating subject could cause different users to get the same identifier generated, depending on the attributes available for them right after authentication.</p> <p>Please note that even though this is possible thanks to a bug, **an IdP must be misconfigured** to release persistent `NameID`s even if it is not properly configured to generate them based on the specifics of the deployment.</p> <p>### Description Persistent `NameID`s will typically be sent as part of the `Subject` element of a SAML assertion, or as the contents of the `eduPersonTargetedID` attribute. Here is an example of such a `NameID`:</p> <p>&lt;NameID Format=“urn:oasis:names:tc:SAML:2.0:nameid-format:persistent“&gt; zbonsm0Yn9Gnw14uQEEPr6AO7d+IvxwCQN3t+o24jYs= &lt;/NameID&gt;</p> <p>Some service providers will use this information to identify a user across sessions because a persistent `NameID` will never change for a given user. This could lead to different users accessing the same account in those service providers.</p> <p>In order to be affected by this issue, the following circumstances must concur:</p> <p>- SimpleSAMLphp acts as an identity provider. - The service provider asking for authentication requests a persistent `NameID`. - No `saml:PersistentNameID` authentication processing filter is configured (neither for the whole IdP, nor for a given SP). - No `simplesa…</p> https://cve.radiocsirt.org/vuln/ghsa-gp2m-7cfp-h6gf https://cve.radiocsirt.org/vuln/gsd-2017-12873 gsd-2017-12873 https://cve.radiocsirt.org/vuln/gsd-2017-12873 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-12873 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: simplesamlphp</p> <p>SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: simplesamlphp</p> <p>SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-12873