Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/simplesamlphp/simplesamlphp@1.14.13
Typecomposer
Namespacesimplesamlphp
Namesimplesamlphp
Version1.14.13
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version1.14.17
Latest_non_vulnerable_version1.17.0
Affected_by_vulnerabilities
0
url VCID-va8h-3qxg-uqh2
vulnerability_id VCID-va8h-3qxg-uqh2
summary 
Session fixation issue and authentication bypass
The `secureCompare` method in `lib/SimpleSAML/Utils/Crypto` when used with PHP, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
references
0
reference_url https://simplesamlphp.org/security/201705-01
reference_id
reference_type
scores
url https://simplesamlphp.org/security/201705-01
1
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-12868
reference_id CVE-2017-12868
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2017-12868
fixed_packages
0
url pkg:composer/simplesamlphp/simplesamlphp@1.14.14
purl pkg:composer/simplesamlphp/simplesamlphp@1.14.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gwtm-bdae-3ufj
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/simplesamlphp/simplesamlphp@1.14.14
aliases CVE-2017-12868
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-va8h-3qxg-uqh2
Fixing_vulnerabilities
0
url VCID-dvwj-zd42-nbhe
vulnerability_id VCID-dvwj-zd42-nbhe
summary 
Information Exposure
SimpleSAMLphp makes it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the `aesEncrypt` and `aesDecrypt` methods in the `SimpleSAML/Utils/Crypto` class to protect session identifiers in replies to non-HTTPS service providers.
references
0
reference_url https://simplesamlphp.org/security/201704-01
reference_id
reference_type
scores
url https://simplesamlphp.org/security/201704-01
1
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-12870
reference_id CVE-2017-12870
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2017-12870
fixed_packages
0
url pkg:composer/simplesamlphp/simplesamlphp@1.14.13
purl pkg:composer/simplesamlphp/simplesamlphp@1.14.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-va8h-3qxg-uqh2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/simplesamlphp/simplesamlphp@1.14.13
aliases CVE-2017-12870
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dvwj-zd42-nbhe
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/simplesamlphp/simplesamlphp@1.14.13