USN-7364-1
opensaml vulnerability
No scoreFix available
Alexander Tan discovered that the OpenSAML C++ library was susceptible to forging of signed SAML messages. An attacker could possibly use this issue to gain unauthorized access to a system and manipulate sensitive information.
What each source reports
OSV No score
opensaml vulnerability
Alexander Tan discovered that the OpenSAML C++ library was susceptible to forging of signed SAML messages. An attacker could possibly use this issue to gain unauthorized access to a system and manipulate sensitive information.
- Record
USN-7364-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensaml2Ubuntu:Pro:16.04:LTS |
before 2.5.5-1ubuntu0.1+esm1, plus listed versions 2.5.3-2.1ubuntu22.5.5-12.5.5-1ubuntu0.1 |
2.5.5-1ubuntu0.1+esm1 |
opensaml2Ubuntu:Pro:18.04:LTS |
before 2.6.1-1ubuntu0.1~esm1, plus listed versions 2.6.0-42.6.0-52.6.0-5build12.6.1-1 |
2.6.1-1ubuntu0.1~esm1 |
opensamlUbuntu:20.04:LTS |
before 3.0.1-1ubuntu0.1, plus listed versions 3.0.1-13.0.1-1build1 |
3.0.1-1ubuntu0.1 |
opensamlUbuntu:22.04:LTS |
before 3.2.1-1ubuntu0.1, plus listed versions 3.2.0-2ubuntu13.2.1-1 |
3.2.1-1ubuntu0.1 |
opensamlUbuntu:24.04:LTS |
before 3.2.1-4.1ubuntu0.24.04.1, plus listed versions 3.2.1-33.2.1-43.2.1-4.1build13.2.1-4.1build2 |
3.2.1-4.1ubuntu0.24.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-7364-1 is a vulnerability with no CVSS score yet in opensaml, published March 21, 2025. No source lists public exploit code. Fixed in opensaml2 2.5.5-1ubuntu0.1+esm1.