{"id":"USN-8770-1","summary":"simplesamlphp vulnerabilities","details":"It was discovered that SimpleSAMLphp incorrectly validated cryptographic\nsignatures in XML messages. An authenticated attacker could possibly use\nthis issue to impersonate users or gain elevated privileges. This issue\nonly affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-3465)\n\nIt was discovered that SimpleSAMLphp incorrectly handled external entities\nwhen parsing untrusted XML documents. A remote attacker could possibly use\nthis issue to obtain sensitive information. This issue did not affect\nUbuntu 24.04 LTS. (CVE-2024-52596)\n\nIt was discovered that SimpleSAMLphp incorrectly verified signatures in\nSAML messages using the HTTP-Redirect binding. A remote attacker could\npossibly use this issue to bypass authentication and impersonate users.\n(CVE-2025-27773)","modified":"2026-09-16T02:57:30.323585081Z","published":"2026-09-15T16:16:00Z","related":["UBUNTU-CVE-2019-3465","UBUNTU-CVE-2024-52596","UBUNTU-CVE-2025-27773"],"upstream":["CVE-2019-3465","CVE-2024-52596","CVE-2025-27773","UBUNTU-CVE-2019-3465","UBUNTU-CVE-2024-52596","UBUNTU-CVE-2025-27773"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8770-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-3465"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-52596"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2025-27773"}],"affected":[{"package":{"name":"simplesamlphp","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/simplesamlphp?arch=source&distro=esm-apps-legacy%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1ubuntu2+esm1"}]}],"versions":["1.13.2-1","1.14.0-1","1.14.0-1ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_version":"1.14.0-1ubuntu2+esm1","binary_name":"simplesamlphp"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:16.04:LTS","cves":[{"id":"CVE-2019-3465","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2024-52596","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:L/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2025-27773","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"},{"score":"medium","type":"Ubuntu"}]}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8770-1.json"}},{"package":{"name":"simplesamlphp","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/simplesamlphp?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-1ubuntu0.1~esm1"}]}],"versions":["1.14.15-1","1.15.0-1","1.15.1-1","1.15.2-1","1.15.3-1"],"ecosystem_specific":{"binaries":[{"binary_name":"simplesamlphp","binary_version":"1.15.3-1ubuntu0.1~esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8770-1.json","cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2019-3465"},{"id":"CVE-2024-52596","severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:L/SA:N","type":"CVSS_V4"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2025-27773","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"},{"score":"medium","type":"Ubuntu"}]}]}}},{"package":{"name":"simplesamlphp","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/simplesamlphp?arch=source&distro=esm-apps%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-1ubuntu0.1~esm1"}]}],"versions":["1.17.5-1","1.17.6-1","1.17.6-2","1.18.1-1","1.18.4-1"],"ecosystem_specific":{"binaries":[{"binary_name":"simplesamlphp","binary_version":"1.18.4-1ubuntu0.1~esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:20.04:LTS","cves":[{"id":"CVE-2024-52596","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:L/SA:N"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2025-27773"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8770-1.json"}},{"package":{"name":"simplesamlphp","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/simplesamlphp?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.1-1.1ubuntu0.1~esm1"}]}],"versions":["1.19.1-1","1.19.1-1.1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"simplesamlphp","binary_version":"1.19.1-1.1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8770-1.json","cves_map":{"ecosystem":"Ubuntu:Pro:22.04:LTS","cves":[{"id":"CVE-2024-52596","severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:L/SA:N","type":"CVSS_V4"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2025-27773"}]}}},{"package":{"name":"simplesamlphp","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/simplesamlphp?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.7-1+deb12u1ubuntu0.1"}]}],"versions":["1.19.7-1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"simplesamlphp","binary_version":"1.19.7-1+deb12u1ubuntu0.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8770-1.json","cves_map":{"ecosystem":"Ubuntu:24.04:LTS","cves":[{"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:L/SA:N"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-52596"},{"id":"CVE-2025-27773","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]}]}}}],"schema_version":"1.9.0"}