GHSA-hw46-3hmr-x9xv omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue
- Exploited in the wild
- Not known
- Fix
- Available
What is GHSA-hw46-3hmr-x9xv?
GHSA-hw46-3hmr-x9xv is a vulnerability in omniauth-saml, published on 12 Mar 2025.
Official description
Summary
There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.
The fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.
Please upgrade the ruby-saml requirement to v1.18.0.
Impact
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
Which versions are affected by GHSA-hw46-3hmr-x9xv?
6 open source packages ship an affected version, including omniauth-saml.
| Package | Affected | Fixed in |
|---|---|---|
omniauth-saml RubyGems | All versions | 1.10.6 |
omniauth-saml RubyGems | All versions | 1.10.6 |
omniauth-saml RubyGems | From 2.0.0 | 2.1.3 |
omniauth-saml RubyGems | From 2.0.0 | 2.1.3 |
omniauth-saml RubyGems | From 2.2.0 | 2.2.3 |
omniauth-saml RubyGems | From 2.2.0 | 2.2.3 |
How do I fix GHSA-hw46-3hmr-x9xv?
Upgrade omniauth-saml to a fixed version for your release line: 1.10.6, 2.1.3 or 2.2.3.
Is GHSA-hw46-3hmr-x9xv being exploited?
There is no known exploitation of GHSA-hw46-3hmr-x9xv in the wild and no public exploit code.