Security Advisories

CGA-5h25-v8p9-m8fp

Published

Last updated

Package

gitlab-rails-ee-17.1

Latest Update

Fixed

Fixed Version

17.1.8-r0

Aliases

Severity

10.0

Critical

CVSS V3

omniauth-saml vulnerable to Improper Verification of Cryptographic Signature

ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a new release by upgrading ruby-saml to the patched versions v1.17.

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

Safe Source for Open Source™