CVE-2024-47832
Description
ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability.
How to fix
- ssoready ssoready2024-10-09 or later
- github.com/ssoready/ssoready0.0.0-20241009153838-7f92a0630439 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ssoready ssoready | v < 2024-10-09 | 2024-10-09 |
| github.com/ssoready/ssoreadyGo | v < 0.0.0-20241009153838-7f92a0630439, No range specified | 0.0.0-20241009153838-7f92a0630439 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.