{"id":"CVE-2019-3465","aliases":["DEBIAN-CVE-2019-3465","DLA-1983-1","DSA-4560-1","EUVD-2019-0760","GHSA-pqm6-cgwr-x6pf","UBUNTU-CVE-2019-3465","USN-8770-1"],"status":"published","title":"Signature validation bypass in XmlSecLibs","description":"Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02988,"percentile":0.87407,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2019-11-06T00:00:00Z","modified":"2026-10-24T10:47:43Z","fixes":[{"ecosystem":"Packagist","package":"robrichards/xmlseclibs","fixed_in":["3.0.4","2.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"simplesamlphp","fixed_in":["1.17.6-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"simplesamlphp","fixed_in":["1.17.6-2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"simplesamlphp","fixed_in":["1.13.1-2+deb8u3"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"simplesamlphp","fixed_in":["1.14.11-1+deb9u2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"simplesamlphp","fixed_in":["1.16.3-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"simplesamlphp","fixed_in":["1.14.0-1ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"simplesamlphp","fixed_in":["1.15.3-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"robrichards/xmlseclibs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"robrichards/xmlseclibs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"2.1.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.6-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.6-2"}]}],"versions":["1.10.0-1","1.11.0-1","1.12.0-1","1.12.0~rc1-1","1.12.0~rc2-1","1.13.0-1","1.13.1-1","1.13.1-2","1.13.2-1","1.14.0-1","1.14.1-1","1.14.10-1","1.14.11-1","1.14.15-1","1.14.2-1","1.14.2-2","1.14.3-1","1.14.4-1","1.14.5-1","1.14.6-1","1.14.7-1","1.14.8-1","1.14.9-1","1.15.0-1","1.15.1-1","1.15.2-1","1.15.3-1","1.15.4-1","1.16.0-1","1.16.1-1","1.16.2-1","1.16.3-1","1.17.0-1","1.17.1-1","1.17.2-1","1.17.2-2","1.17.3-1","1.17.4-1","1.17.5-1","1.17.6-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.3-2","1.6.3-3","1.7.0-1","1.7.0-2","1.8.0-1","1.8.1-1","1.8.2-1","1.9.0-1","1.9.0~rc1-1","1.9.0~rc2-1","1.9.1-1","1.9.2-1"]},{"source":"osv","ecosystem":"Debian:8","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-2+deb8u3"}]}],"versions":["1.13.1-2","1.13.1-2+deb8u1","1.13.1-2+deb8u2"]},{"source":"osv","ecosystem":"Debian:9","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.11-1+deb9u2"}]}],"versions":["1.14.11-1","1.14.11-1+deb9u1"]},{"source":"osv","ecosystem":"Debian:10","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-1+deb10u1"}]}],"versions":["1.16.3-1"]},{"source":"osv","ecosystem":"Packagist","package":"robrichards/xmlseclibs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.4"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3"]},{"source":"osv","ecosystem":"Packagist","package":"robrichards/xmlseclibs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"2.1.1"}]}],"versions":["1.3.2","1.3.3","1.3.4","1.4.0","1.4.1","1.4.2","1.4.3","2.0.0","2.0.1","2.1.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1ubuntu2+esm1"}]}],"versions":["1.13.2-1","1.14.0-1","1.14.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-1ubuntu0.1~esm1"}]}],"versions":["1.14.15-1","1.15.0-1","1.15.1-1","1.15.2-1","1.15.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1ubuntu2+esm1"}]}],"versions":["1.13.2-1","1.14.0-1","1.14.0-1ubuntu2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-1ubuntu0.1~esm1"}]}],"versions":["1.14.15-1","1.15.0-1","1.15.1-1","1.15.2-1","1.15.3-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-1ubuntu0.1~esm1"}]}],"versions":["1.17.5-1","1.17.6-1","1.17.6-2","1.18.1-1","1.18.4-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.1-1.1ubuntu0.1~esm1"}]}],"versions":["1.19.1-1","1.19.1-1.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.7-1+deb12u1ubuntu0.1"}]}],"versions":["1.19.7-1"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"simplesamlphp","product":"simplesamlphp"},{"vendor":"xmlseclibs_project","product":"xmlseclibs"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2019/11/msg00003.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Nov/8","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Issue Tracking","Mailing List","Third Party Advisory","report","web"]},{"url":"https://www.debian.org/security/2019/dsa-4560","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/robrichards/xmlseclibs/commit/0a53d3c3aa87564910cae4ed01416441d3ae0db5","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://simplesamlphp.org/security/201911-01","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AB34ILMJ67CUROBOR6YPKB46VHXLOAJ4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAWOVYLZKYDCQBLQEJCFAAD3KQTBPHXE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ESKJTWLE7QZBQ3EKMYXKMBQG3JDEJWM6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7KID7C4AZPYYIZQIPSLANP4R2RQR6YK3/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XBSSRV5Q7JFCYO46A3EN624UZ4KXFQ2M/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HBE2SJSXG7J4XYLJ2H6HC2VPPOG2OMUN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.tenable.com/security/tns-2019-09","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BNFMY5RRLU63P25HEBVDO5KAVI7TX7JV/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBKVDUZ7G5ZOUO4BFJWLNJ6VOKBQJX5U/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OCSR3V6LNWJAD37VQB6M2K7P4RQSCVFG/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3465","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7KID7C4AZPYYIZQIPSLANP4R2RQR6YK3/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AB34ILMJ67CUROBOR6YPKB46VHXLOAJ4/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ESKJTWLE7QZBQ3EKMYXKMBQG3JDEJWM6/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HBE2SJSXG7J4XYLJ2H6HC2VPPOG2OMUN/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAWOVYLZKYDCQBLQEJCFAAD3KQTBPHXE/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBSSRV5Q7JFCYO46A3EN624UZ4KXFQ2M/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBKVDUZ7G5ZOUO4BFJWLNJ6VOKBQJX5U/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BNFMY5RRLU63P25HEBVDO5KAVI7TX7JV/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCSR3V6LNWJAD37VQB6M2K7P4RQSCVFG/"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/robrichards/xmlseclibs/CVE-2019-3465.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pqm6-cgwr-x6pf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3465","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBSSRV5Q7JFCYO46A3EN624UZ4KXFQ2M","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCSR3V6LNWJAD37VQB6M2K7P4RQSCVFG","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAWOVYLZKYDCQBLQEJCFAAD3KQTBPHXE","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HBE2SJSXG7J4XYLJ2H6HC2VPPOG2OMUN","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ESKJTWLE7QZBQ3EKMYXKMBQG3JDEJWM6","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BNFMY5RRLU63P25HEBVDO5KAVI7TX7JV","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBKVDUZ7G5ZOUO4BFJWLNJ6VOKBQJX5U","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AB34ILMJ67CUROBOR6YPKB46VHXLOAJ4","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7KID7C4AZPYYIZQIPSLANP4R2RQR6YK3","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-3465","tags":["report"]},{"url":"https://groups.google.com/forum/#!msg/simplesamlphp-announce/2odMqz63z7k/6zQQeM91EwAJ","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3465","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8770-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-52596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-27773","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-3465","description":"Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.","status":"published","published":"2019-11-07T19:12:33Z","modified":"2024-08-04T19:12:09.411Z","updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-0760","description":"Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.","status":"published","published":"2019-11-07T19:12:33Z","modified":"2024-08-04T19:12:09Z","updated_at":"2026-11-03T03:06:55.481882Z"}],"ghsa":[{"id":"GHSA-pqm6-cgwr-x6pf","title":"Signature validation bypass in XmlSecLibs","description":"Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.","status":"published","published":"2019-11-08T20:06:46Z","modified":"2024-02-06T09:51:31Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:37:36.076201Z"}],"nvd":[{"id":"CVE-2019-3465","description":"Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.","status":"published","published":"2019-11-07T20:15:11.09Z","modified":"2026-06-17T02:35:10.1Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:05:35.052973Z"}],"osv":[{"id":"CVE-2019-3465","description":"Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.","status":"published","published":"2019-11-07T20:15:11.09Z","modified":"2026-10-24T10:47:43.32183025Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3465","description":"Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.","status":"published","published":"2019-11-07T20:15:11.09Z","modified":"2026-09-21T07:01:40.066519019Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"GHSA-pqm6-cgwr-x6pf","title":"Signature validation bypass in XmlSecLibs","description":"Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.","status":"published","published":"2019-11-08T20:06:46Z","modified":"2024-03-14T05:19:10.168412Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"UBUNTU-CVE-2019-3465","description":"Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.","status":"published","published":"2019-11-07T20:15:00Z","modified":"2026-09-15T20:16:38.164329234Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DLA-1983-1","title":"simplesamlphp - security update","status":"published","published":"2019-11-06T00:00:00Z","modified":"2026-03-09T01:22:03.295197Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4560-1","title":"simplesamlphp - security update","status":"published","published":"2019-11-06T00:00:00Z","modified":"2026-03-09T02:09:48.368535Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"USN-8770-1","title":"simplesamlphp vulnerabilities","description":"It was discovered that SimpleSAMLphp incorrectly validated cryptographic\nsignatures in XML messages. An authenticated attacker could possibly use\nthis issue to impersonate users or gain elevated privileges. This issue\nonly affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-3465)\n\nIt was discovered that SimpleSAMLphp incorrectly handled external entities\nwhen parsing untrusted XML documents. A remote attacker could possibly use\nthis issue to obtain sensitive information. This issue did not affect\nUbuntu 24.04 LTS. (CVE-2024-52596)\n\nIt was discovered that SimpleSAMLphp incorrectly verified signatures in\nSAML messages using the HTTP-Redirect binding. A remote attacker could\npossibly use this issue to bypass authentication and impersonate users.\n(CVE-2025-27773)","status":"published","published":"2026-09-15T16:16:00Z","modified":"2026-09-16T02:57:27.4192406Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}