CVE-2021-39171
Medium
Description
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
SeverityMedium
CVSS5.3
Exploit probability—
ProductPassport-saml
PublishedAug 27, 2021
First seenAug 27, 2021
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- passport-saml_project passport-saml3.1.0 or later
- passport-saml3.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| passport-saml_project passport-saml | v < 3.1.0 | 3.1.0 |
| passport-samlnpm | v < 3.1.0 | 3.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.