VYPR
← All advisories
High severity8.8NVD Advisory· Published Nov 7, 2019· Updated Jun 17, 2026

CVE-2019-3465

CVE-2019-3465

Description

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
robrichards/xmlseclibsPackagist
>= 3.0.0, < 3.0.43.0.4
robrichards/xmlseclibsPackagist
>= 1.0.0, < 2.1.12.1.1

Affected products

7
  • Simplesamlphp/Simplesamlphp
    cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:*
    Range: <=1.17.6
  • Xmlseclibs Project/Xmlseclibs
    cpe:2.3:a:xmlseclibs_project:xmlseclibs:*:*:*:*:*:*:*:*
    Range: >=1.0.0,<=1.4.2
  • Debian/linux3 versions
    cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • Rob Richards/XmlSecLibsdescription
  • ghsa-coords
    pkg:composer/robrichards/xmlseclibs
    Range: >= 3.0.0, < 3.0.4

Patches

Vulnerability mechanics

References

27

News mentions

0

No linked articles in our index yet.