-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) Differential XML parsing between ReXML (lenient) and Nokogiri (strict), particularly around DOCTYPE handling and namespace resolution. 2) Lack of consistency in XML processing between signature extraction (ReXML) and canonicalization (Nokogiri). The commit diffs show critical fixes in these areas: adding SAML_NAMESPACES to prevent XPath mismatches, implementing safe_load_xml with DOCTYPE validation, and separating parser workflows. The vulnerable functions directly handled XML parsing/validation without these safeguards.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ruby-saml | rubygems | < 1.12.4 | 1.12.4 |
| ruby-saml | rubygems | >= 1.13.0, < 1.18.0 | 1.18.0 |
A Semantic Attack on Google Gemini - Read the Latest Research