Sicherheit: Mehrere Probleme in Ruby

Lesezeichen hinzufügen

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============6480222410917679539==
Content-Language: en-US
Content-Type: multipart/signed; micalg=pgp-sha256;
protocol="application/pgp-signature";
boundary="------------K8qRSRPVbgwFUviGkz3COzWU"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------K8qRSRPVbgwFUviGkz3COzWU
Content-Type: multipart/mixed;
boundary="------------WIuBRKyVwRmhyDB7IqMy7nXu";
protected-headers="v1"
From: Elise Hlady <elise.hlady@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID: <5d4a9a97-d4f0-40c9-a15d-edbd1a902a46@canonical.com>
Subject: [USN-7309-1] Ruby SAML vulnerabilities

--------------WIuBRKyVwRmhyDB7IqMy7nXu
Content-Type: multipart/mixed;
boundary="------------BTJvqjmaiaRDIzW8WobpRkr6"

--------------BTJvqjmaiaRDIzW8WobpRkr6
Content-Type: multipart/alternative;
boundary="------------Zlnx1BQTTCzo8gcTOxeGoSvj"

--------------Zlnx1BQTTCzo8gcTOxeGoSvj
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

==========================================================================
Ubuntu Security Notice USN-7309-1
February 28, 2025

Ruby SAML vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Ruby SAML.

Software Description:
- ruby-saml: SAML toolkit for Ruby on Rails

Details:

It was discovered that Ruby SAML did not properly validate SAML responses.
An unauthenticated attacker could use this vulnerability to log in as an
abitrary user. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-5697)

It was discovered that Ruby SAML incorrectly utilized the results of XML
DOM traversal and canonicalization APIs. An unauthenticated attacker could
use this vulnerability to log in as an abitrary user. This issue only
affected Ubuntu 16.04 LTS. (CVE-2017-11428)

It was discovered that Ruby SAML did not properly verify the signature of
the SAML Response, allowing multiple elements with the same ID. An
unauthenticated attacker could use this vulnerability to log in as an
abitrary user. (CVE-2024-45409)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
ruby-saml 1.15.0-1ubuntu0.24.10.1

Ubuntu 24.04 LTS
ruby-saml 1.15.0-1ubuntu0.24.04.1

Ubuntu 22.04 LTS
ruby-saml 1.13.0-1ubuntu0.1

Ubuntu 20.04 LTS
ruby-saml 1.11.0-1ubuntu0.1

Ubuntu 18.04 LTS
ruby-saml 1.7.2-1ubuntu0.1~esm1
Available with Ubuntu Pro

Ubuntu 16.04 LTS
ruby-saml 1.1.2-1ubuntu1+esm1
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7309-1
<https://ubuntu.com/security/notices/USN-7309-1>
CVE-2016-5697, CVE-2017-11428, CVE-2024-45409

Package Information:
https://launchpad.net/ubuntu/+source/ruby-saml/1.15.0-1ubuntu0.24.10.1
<https://launchpad.net/ubuntu/+source/ruby-saml/1.15.0-1ubuntu0.24.10.1>
https://launchpad.net/ubuntu/+source/ruby-saml/1.15.0-1ubuntu0.24.04.1
<https://launchpad.net/ubuntu/+source/ruby-saml/1.15.0-1ubuntu0.24.04.1>
https://launchpad.net/ubuntu/+source/ruby-saml/1.13.0-1ubuntu0.1
<https://launchpad.net/ubuntu/+source/ruby-saml/1.13.0-1ubuntu0.1>
https://launchpad.net/ubuntu/+source/ruby-saml/1.11.0-1ubuntu0.1
<https://launchpad.net/ubuntu/+source/ruby-saml/1.11.0-1ubuntu0.1>

--------------Zlnx1BQTTCzo8gcTOxeGoSvj
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html>
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html;
charset=3DUTF=
-8">
</head>
<body>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
<div id=3D":1ep" class=3D"a3s aiL "> Ubuntu Security
Notice USN-7309-=
1 
February 28, 2025 
 
Ruby SAML vulnerabilities 
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=
=3D=3D=3D=3D=3D 
 
A security issue affects these releases of Ubuntu and its
derivatives: 
 
- Ubuntu 24.10 
- Ubuntu 24.04 LTS 
- Ubuntu 22.04 LTS 
- Ubuntu 20.04 LTS 
- Ubuntu 18.04 LTS 
- Ubuntu 16.04 LTS 
 
Summary: 
 
Several security issues were fixed in Ruby SAML. 
 
Software Description: 
- ruby-saml: SAML toolkit for Ruby on Rails 
 
Details: 
 
It was discovered that Ruby SAML did not properly validate SAML
responses. 
An unauthenticated attacker could use this vulnerability to log in
as an 
abitrary user. This issue only affected Ubuntu 16.04 LTS.
(CVE-2016-5697) 
 
It was discovered that Ruby SAML incorrectly utilized the results
of XML 
DOM traversal and canonicalization APIs. An unauthenticated
attacker could 
use this vulnerability to log in as an abitrary user. This issue
only 
affected Ubuntu 16.04 LTS. (CVE-2017-11428) 
 
It was discovered that Ruby SAML did not properly verify the
signature of 
the SAML Response, allowing multiple elements with the same ID. An
 
unauthenticated attacker could use this vulnerability to log in as
an 
abitrary user. (CVE-2024-45409) 
 
Update instructions: 
 
The problem can be corrected by updating your system to the
following 
package versions: 
 
Ubuntu 24.10 
=C2=A0 ruby-saml=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A01.15.0-1ubuntu0.24.10.1 
 
Ubuntu 24.04 LTS 
=C2=A0 ruby-saml=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A01.15.0-1ubuntu0.24.04.1 
 
Ubuntu 22.04 LTS 
=C2=A0 ruby-saml=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A01.13.0-1ubuntu0.1 
 
Ubuntu 20.04 LTS 
=C2=A0 ruby-saml=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A01.11.0-1ubuntu0.1 
 
Ubuntu 18.04 LTS 
=C2=A0 ruby-saml=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A01.7.2-1ubuntu0.1~esm1 
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Available with Ubuntu P=
ro 
 
Ubuntu 16.04 LTS 
=C2=A0 ruby-saml=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A01.1.2-1ubuntu1+esm1 
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Available with Ubuntu P=
ro 
 
In general, a standard system update will make all the necessary
changes. 
 
References: 
=C2=A0 <a href=3D"https://ubuntu.com/security/notices/USN-7309-1"
rel=3D"noreferrer" target=3D"_blank"
data-saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://ubuntu.com=
/security/notices/USN-7309-1&source=3Dgmail&ust=3D174085033302100
=
0&usg=3DAOvVaw2pWnE-heC8QTany_Ippyml">https://ubuntu.com/security/no<=
wbr>tices/USN-7309-1</a> 
=C2=A0 CVE-2016-5697, CVE-2017-11428, CVE-2024-45409 
 
Package Information: 
=C2=A0 <a
href=3D"https://launchpad.net/ubuntu/+source/ruby-saml/1.15.0-1ubuntu0.24=
=2E10.1"
rel=3D"noreferrer" target=3D"_blank"
data-saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://launchpad.=
net/ubuntu/%2Bsource/ruby-saml/1.15.0-1ubuntu0.24.10.1&source=3Dgmail=
&ust=3D1740850333021000&usg=3DAOvVaw14J1SfB7AdSTxFG1FZjSxl">https
=
://launchpad.net/ubuntu/+source/ruby-saml/1.15.0-1ubuntu0.24.10
=
=2E1</a> 
=C2=A0 <a
href=3D"https://launchpad.net/ubuntu/+source/ruby-saml/1.15.0-1ubuntu0.24=
=2E04.1"
rel=3D"noreferrer" target=3D"_blank"
data-saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://launchpad.=
net/ubuntu/%2Bsource/ruby-saml/1.15.0-1ubuntu0.24.04.1&source=3Dgmail=
&ust=3D1740850333021000&usg=3DAOvVaw0XDMfyhd2LWZw3AMbmqGKR">https
=
://launchpad.net/ubuntu/+source/ruby-saml/1.15.0-1ubuntu0.24.04
=
=2E1</a> 
=C2=A0 <a
href=3D"https://launchpad.net/ubuntu/+source/ruby-saml/1.13.0-1ubuntu0.1"=

rel=3D"noreferrer" target=3D"_blank"
data-saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://launchpad.=
net/ubuntu/%2Bsource/ruby-saml/1.13.0-1ubuntu0.1&source=3Dgmail&u
=
st=3D1740850333021000&usg=3DAOvVaw1JLRhi6u-0TKCgEQRi_Asv">https://lau=
nchpad.net/ubuntu/+source/ruby-saml/1.13.0-1ubuntu0.1</a> 
;
=C2=A0 <a
href=3D"https://launchpad.net/ubuntu/+source/ruby-saml/1.11.0-1ubuntu0.1"=

rel=3D"noreferrer" target=3D"_blank"
data-saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://launchpad.=
net/ubuntu/%2Bsource/ruby-saml/1.11.0-1ubuntu0.1&source=3Dgmail&u
=
st=3D1740850333021000&usg=3DAOvVaw0kU2XgxFg4BQGZTQ3Sv243">https://lau=
nchpad.net/ubuntu/+source/ruby-saml/1.11.0-1ubuntu0.1</a>
;
<div class=3D"adL"> 
</div>
</div>
</body>
</html>

--------------Zlnx1BQTTCzo8gcTOxeGoSvj--

--------------BTJvqjmaiaRDIzW8WobpRkr6
Content-Type: application/pgp-keys;
name="OpenPGP_0xB6F2490E12CCDC93.asc"
Content-Disposition: attachment;
filename="OpenPGP_0xB6F2490E12CCDC93.asc"
Content-Description: OpenPGP public key
Content-Transfer-Encoding: quoted-printable

-----BEGIN PGP PUBLIC KEY BLOCK-----

xsFNBGeBatcBEADjeQnyxPSr7H1YUPEsajiaOvZWs8PDHdaNFnE/tc9VxO6VcKYi
QkhLrsjmWhho7/lZ4JhtRD1btqRisXdvo9y+1gcDUxzBERjgACKJbKtS0kdxnq5q
DSePEos7IrcSo1XQBuRIdgWX3NEcdlEVzq5wKrmB+DdULg1SpY6k7gXvImUGPAR5
KMAuy/5opJxB9BWhJMgcO3SJiz5nkKBMUb1sUHL/vvBeYrg4PGHgmK7ueHjMz5em
ezMLlA8LribR7QC1LfQSMIgIG5iD/J2HQoEvTxxUxU9LguyAiXnCSnnvnHtfiipp
w7dQBPok49ivobZKCjZtq/GaSi7DX2aZlLIinykA7vyUdJ0bZjvlxfvWxgpaiyvH
7YcApMbJXXjGw+e1/jYMu/fmG7MfABLGOvVoCjUAfYBLRO+dQjOh5X/sZK7jZ2PI
3vK3YQTc0UGMapnMRgUvxCZxgSFZDcJ2kqm4GQtK7d7prf/F3vLR/gtPS5i8jd25
tNi0ZC+kFCBn08UFq0UFFWvnmh7ppFPHRr38Xx8eODwDPOcJWE0I3rQMk6LDHi+q
m+pc7CWar7DGhINp4aRFYdbRH6zjSI61ykUc0nwsONfnc0Np6T1OMOU3DyXgHHFz
WFXux0mrzAq/5gjA6mv2JJY1fOhuFnsIzNG7WCe9huJRJEiIfOCVo7IlJQARAQAB
zSdFbGlzZSBIbGFkeSA8ZWxpc2UuaGxhZHlAY2Fub25pY2FsLmNvbT7CwZEEEwEK
ADsWIQQH+DF/t3wJ3Y4qGom28kkOEszckwUCZ4Fq1wIbAwULCQgHAgIiAgYVCgkI
CwIEFgIDAQIeBwIXgAAKCRC28kkOEszck2lkD/9y+cQNytnBgIwCmHSGn1f2XYNc
sgWAwtdAAlgo/50SE/ayGJKKER4vUlN/PQg1tyGfQJFrvqd9e+pkWpnPYYdBuJpo
Dy2ipQPbmJ3CZsS1q+9CMPNmokYVORWg55YHRsgB8PdypA3lu59Zg6jdoZAYjjXl
3CVo8CoYvp0YxHFiMgGfCRIMkm4sHltFrKbmHdi3L7yxf7C8TTbl1uMAfs22zzqo
SRaG/q/G6782wvTurlM8Nr+uJqm4WFKMy2pWsVWrRusa4bilc8a0Kosk/a+E/4cH
7lfLIeK7pGOpEyEDRm7jzuzaxuMI2Y8dAT2xa7YVPMXKgH0qsb0HiQpPMgrI1CXn
UxHCfcrZd68cN6eNKU9JH2Hz2w6Owfgysci/nqDr0/3qajY2+NY92+lsEWqtgMWQ
R6ycYtpE4WRshDPHm658aaG6V2jgC4Z5LlPa2uY6Zqjm7b0mBMKs1eLfq7uiGQhu
YJ8eQBArsYmavQAyIMxdAvhqaGYvQPFIv+TPJxCXGsKP9/Lykv3fq18oQFjoRiDy
XMBs7saHrJGfWr8MvTPPMOEqThNmdxEEQW7DdcjIrhEoTXlASCdYzMQMluIoxlSV
yDPzXUh50lkFFcEe0G09FDzfNQWdkDohBPjPMcxBZjWducKcrhVNK98ftbW4nZyB
VW9NwihohGOwhir0XM7BTQRngWrXARAAwjuOxPaESvIAi+SUDluDZK5ClLXIZRTe
nV93C+eOZQEgLw1UxEpwRJjr8odzfDkzuoyVP+tzruTPJqzcyGrMDZUtJuk/Ljc1
vy3zISlNI0EKk5G3KRzhuDu+CKVDsSqjnOdXRsRahpTof8kfdJeRzxVQMT/MrMls
FF96163kreVWCMSmS8x20Y0fmDm0ei0aCmE6bKwDrEElesAl0O646YckVeDXsylj
TBLJ/pezHgfBxegO/AweuMHqpHeUuC3AuqZTbFCFTET/M1LNI9lJFTgfEAsJ6Bvh
5b9dF87D/s1TDBuMU0XiX69idFE2O5DeaN6mv44xO49ovpNEVeIJOYTxXMXCoLEy
FLe9UJMnu/5jxmdXavJm3/CgzdV4aj7F1zcTWdndFtklWr2sfFG2+Udelwxtx+sR
qvdlfFu/BncceLIklMeXv0cNxvpSkZlEobpfJFPhAhpce8L3Kkay66Acx7/LB3L1
Yo1fihePbPoAowRjUR8LIuXuAUT82sD3Gd61P9Xi3yMG7Q9Y/xUyL260y+JDh9tt
MvnyADbALeiwb5tL6YxEiSScoWLXCi7A+UODDa50mNsmV6a5Dt6/ejzL/nkfQYFj
l3uydBLfCXGAcT9vwwwJ9KWKSoJwZwMn5P1EDJh7e+khb39dSiSr9EYgj2fDs07Y
Ug8+4m/CnS8AEQEAAcLBdgQYAQoAIBYhBAf4MX+3fAndjioaibbySQ4SzNyTBQJn
gWrXAhsMAAoJELbySQ4SzNyTr1MQAMFipPvbsiASQt0bsaNiPDJ6csqrBKKjDmUU
hnWhwvhbJvH6f7RCJbWKTYBYeqh7p9mBmoQhB3R4de3RtKM7AXzZS2AtVZA7e8Z/
O6wsYfKzbpGqgwDe3PChvMFhwsOTajU+yKbtM49TBABD2deUiRcPRMR3uqj9kh+i
4L0JmpIajoQNV2shF8G9GWQ4GSyah/R04kfXepMNlS0CLLIQ869DGPvddog+qjDk
OenqYW+KlKLu0iYPMYMUxllsv/mllc5VD8suXxSxXKu7I1ABj2Ulw0Jfg62KXqG+
1T3cMyM1U5Wx2vdp7kQ6Jee5flsp9xbR/fXfQLw5T4oXjyaBgUcP8Uwvvb9t7BuY
r79gCFIPf85/QddpnT7F/k05XrC39uqVfcBEg78ZKCET+ldDN9cimWVorh9WpOCt
O8AjoQeZC8nFxQpHtgOCuG833SQQFehizKJqscJ3JoKNGawNGXg29yNuzABMCBuZ
Vr4oKe6dNaxe/NtLruPEfT/HPlENJtD2B0PF/Mj02tOyOz81U4rvXBPasjCBXbXJ
u6akPZaj9ptb0IxEdUMX04doHIQ2aB+GBtknIfvRnDW2fLK17aFc3sOGego/6lBs
uC1kYsrAGMrnj4duMV8K078T06bqPdaKoyMrtjn1UmoDoy4vA0K2NazW1wqki9+t
pBm+TEdF
=3DEqVE
-----END PGP PUBLIC KEY BLOCK-----

--------------BTJvqjmaiaRDIzW8WobpRkr6--

--------------WIuBRKyVwRmhyDB7IqMy7nXu--

--------------K8qRSRPVbgwFUviGkz3COzWU
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature.asc"

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEB/gxf7d8Cd2OKhqJtvJJDhLM3JMFAmfCAYUFAwAAAAAACgkQtvJJDhLM3JM/
UQ//TY5FstVQeFHMyS13XVkoG1lXxRVXKGjPkL71vA+AnSpHqEcUmYr7WEFrsvmwjqt7WKip3VJP
ZrOhultvImeXUP/JN3UMlRMUfqDH++61SiUUumuCZzEXJVPwjYtnU+aLV7jJ5swSOpO3Acq/FZbV
kT29dv1LppPNoFx7kjUIV8wEL8f0UDVUa2+jWNvGNDu1T8KmgYakP2iH3+wSwK4E+qm0Mcof4+6Q
XgO/YGxJTp/nwcmWWhwpbyJrMnIcTrnzt08/A8uFu9kL6FaTqfIIHfK5xDZ04T5vE6luB0AlgumP
lelpAHnb70RBt2y/RJ2ut4MsrfdpZBKeT2weQ9I8RiSo5sqfioCyguY1pfhRcuOTXB7BxiHEMCmJ
eHrvhpAZtF6snuGXqG1t0txzCTENf5R4mzpg5x2fWgSx/pqOO7DweV+770Vwrbo7WfC7Ix/Ii9mt
u4/jhuUm8KiBXKfzEY27tC5gLYZ3kdhU03V0lBpWR9+NWoizGr3/bLmAoa1YqxQEjOZkws/iw9Au
PfCYEcyhpBgcHuNFw0XKb1VuUTXpuMfpTaoDmP0IeCFmNTsvHV6AqNkoORwGge0vcvU0TZDc2w5I
to9PWh1cLNmEBDleB2gNPavBJp0UEL11bEYPU7rsX3De92DCpIwfCYNr9Ci24ro10oxF8uAYaMFC
Q3s=
=QboQ
-----END PGP SIGNATURE-----

--------------K8qRSRPVbgwFUviGkz3COzWU--

--===============6480222410917679539==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

Cg==

--===============6480222410917679539==--