-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing enforcement of signature requirements in SAML message validation. The key vulnerable functions were the validateSignature implementations that: 1) In SamlMessageUtil, returned early for unsigned objects without checking a signatureRequired flag 2) In HttpRedirectBindingUtil, didn't validate() presence of signature parameters before attempting validation. The patch added signatureRequired checks in both locations and modified call sites to pass this configuration. The pre-patch behavior is clearly shown in the diff where these functions lacked signature presence checks and early rejection logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.linecorp.armeria:armeria-saml | maven | <= 1.27.1 | 1.27.2 |
Ongoing coverage of React2Shell