Test ID:	1.3.6.1.4.1.25623.1.1.12.2025.7309.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-7309-1)
Summary:	The remote host is missing an update for the 'ruby-saml' package(s) announced via the USN-7309-1 advisory.
Description:	Summary: The remote host is missing an update for the 'ruby-saml' package(s) announced via the USN-7309-1 advisory. Vulnerability Insight: It was discovered that Ruby SAML did not properly validate SAML responses. An unauthenticated attacker could use this vulnerability to log in as an abitrary user. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-5697) It was discovered that Ruby SAML incorrectly utilized the results of XML DOM traversal and canonicalization APIs. An unauthenticated attacker could use this vulnerability to log in as an abitrary user. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11428) It was discovered that Ruby SAML did not properly verify the signature of the SAML Response, allowing multiple elements with the same ID. An unauthenticated attacker could use this vulnerability to log in as an abitrary user. (CVE-2024-45409) Affected Software/OS: 'ruby-saml' package(s) on Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04, Ubuntu 22.04, Ubuntu 24.04, Ubuntu 24.10. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-5697 http://www.openwall.com/lists/oss-security/2016/06/24/3 Common Vulnerability Exposure (CVE) ID: CVE-2017-11428 https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations https://www.kb.cert.org/vuls/id/475445 Common Vulnerability Exposure (CVE) ID: CVE-2024-45409
Copyright	Copyright (C) 2025 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.