Missing Token Replay Detection
Published Mar 25, 2020
8.2
HIGHCVSS 3.1
EPSS 1.50%
Description
Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use. Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 have a faulty implementation of Token Replay Detection. Token Replay Detection is an important defense measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 and prior versions are not affected. These versions have a correct Token Replay Implementation and are safe to use.
Affected products
-
- Version >= 2.0.0, < 2.5.0StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Sustainsys | Saml2 | n/a |
|
- ≥ 2.0.0 · < 2.5.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (6)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0344 Advisory
- https://github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241 x_refsource_MISCPatchThird Party Advisory
- https://github.com/Sustainsys/Saml2/issues/711 x_refsource_MISCIssue TrackingThird Party Advisory
- https://github.com/Sustainsys/Saml2/security/advisories/GHSA-g6j2-ch25-5mmv x_refsource_CONFIRMThird Party Advisory
- https://github.com/advisories/GHSA-g6j2-ch25-5mmv Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-5261
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0344 | Advisory | |
| https://github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241 | x_refsource_MISCPatchThird Party Advisory | |
| https://github.com/Sustainsys/Saml2/issues/711 | x_refsource_MISCIssue TrackingThird Party Advisory | |
| https://github.com/Sustainsys/Saml2/security/advisories/GHSA-g6j2-ch25-5mmv | x_refsource_CONFIRMThird Party Advisory | |
| https://github.com/advisories/GHSA-g6j2-ch25-5mmv | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2020-5261 |
Change history (0)
No recorded changes yet.