CVE catalog
CVE-2017-11430
ruby-omniauth-saml: CVE-2017-11430
- Severity
- Low
- Source
- [NVD] · [CVE record]
- EPSS
- 2.44% · Oct 25, 2026
OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | ruby-omniauth-saml | bookworm | 2.1.0-2 | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | ruby-omniauth-saml | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [ruby-omniauth-saml]Not affected
Details (2)
2.1.0-2· all · bookwormNot affected
dsa · ruby-omniauth-saml · debian · bookworm
2.1.0-2· all · bookwormNot affected
dsa · ruby-omniauth-saml · debian · bookworm
Observed: