GHSA-G6J2-CH25-5MMV高危已审查

Missing Token Replay Detection in Saml2 Authentication services for ASP.NET

OSV 1.4.0 · github-reviewed · 修改于 2021-01-09 04:24

发布时间

2020-03-26 00:52

GitHub 审查时间

2020-03-25 09:16

NVD 发布时间

2020-03-25 10:15

源文件

advisories/github-reviewed/2020/03/GHSA-g6j2-ch25-5mmv/GHSA-g6j2-ch25-5mmv.json

公告说明

Impact

Token Replay Detection is an important defence in depth measure for Single Sign On solutions. In all previous 2.X versions, the Token Replay Detection is not properly implemented.

Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use.

Patches

The 2.5.0 version is patched.

Workarounds

There are no workarounds with existing versions. Fixing the issue requires code updates.

References

https://en.wikipedia.org/wiki/Replay_attack

For more information

If you have any questions or comments about this advisory:

Comment on #711.
Email us at [email protected] if you think that there are further security issues.

受影响的软件包

NuGet

Sustainsys.Saml2

标识信息

别名 / CVE

CVE-2020-5261

CWE

CWE-294

软件生态

NuGet

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

原始 OSV JSON

{
  "id": "GHSA-g6j2-ch25-5mmv",
  "aliases": [
    "CVE-2020-5261"
  ],
  "details": "### Impact\nToken Replay Detection is an important defence in depth measure for Single Sign On solutions. In all previous 2.X versions, the Token Replay Detection is not properly implemented. \n\nNote that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use.\n\n### Patches\nThe 2.5.0 version is patched.\n\n### Workarounds\nThere are no workarounds with existing versions. Fixing the issue requires code updates.\n\n### References\nhttps://en.wikipedia.org/wiki/Replay_attack\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Comment on #711.\n* Email us at [[email protected]](mailto:[email protected]) if you think that there are further security issues.",
  "summary": "Missing Token Replay Detection in Saml2 Authentication services for ASP.NET",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.5.0"
            }
          ]
        }
      ],
      "package": {
        "name": "Sustainsys.Saml2",
        "ecosystem": "NuGet"
      }
    }
  ],
  "modified": "2021-01-08T20:24:58Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N"
    }
  ],
  "published": "2020-03-25T16:52:49Z",
  "references": [
    {
      "url": "https://github.com/Sustainsys/Saml2/security/advisories/GHSA-g6j2-ch25-5mmv",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5261",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/Sustainsys/Saml2/issues/711",
      "type": "WEB"
    },
    {
      "url": "https://github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-294"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2020-03-25T02:15:00Z",
    "github_reviewed_at": "2020-03-25T01:16:34Z"
  }
}