[SECURITY-L] [Security-news] SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider - Critical - Access bypass - SA-CONTRIB-2020-038

[CSIRT Unicamp]

View online: https://www.drupal.org/sa-contrib-2020-038

Project: SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider [1]
Date: 2020-November-18
Security risk: *Critical* 16∕25
AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Description:
This module enables your users residing at a SAML 2.0 compliant Identity
Provider to login to your Drupal website.

The module has two Authentication Bypass vulnerabilities.

Solution:
Install the latest version:

   * If you use the miniorange_saml module for Drupal 8.x, upgrade to
     miniorange_saml 8.x-2.14 [3]
   * If you use the miniorange_saml module for Drupal 7.x, upgrade to
     miniorange_saml 7.x-2.54 [4]

Reported By:
   * Heine [5] of the Drupal Security Team
   * Michael Mazzolini [6]

Fixed By:
   * abhay19 [7]

Coordinated By:
   * Heine [8] of the Drupal Security Team
   * Chris McCafferty [9] of the Drupal Security Team


[1] https://www.drupal.org/project/miniorange_saml
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/miniorange_saml/releases/8.x-2.14
[4] https://www.drupal.org/project/miniorange_saml/releases/7.x-2.54
[5] https://www.drupal.org/user/17943
[6] https://www.drupal.org/user/3649306
[7] https://www.drupal.org/user/3549350
[8] https://www.drupal.org/user/17943
[9] https://www.drupal.org/user/1850070

_______________________________________________
Security-news mailing list
Security-news em drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news

===
Computer Security Incident Response Team - CSIRT
Universidade Estadual de Campinas - Unicamp
Centro de Computacao - CCUEC
GnuPG Public Key: http://www.security.unicamp.br/security.asc [^]
Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830
-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: <http://www.listas.unicamp.br/pipermail/security-l/attachments/20201118/1e361d97/attachment.html>