Updated advisory posts against rubysec/ruby-advisory-db@7197f4b

RubySec CI · RubySec CI · commit f169fb55b107 · 2016-06-24T19:21:58.000Z
diff --git a/advisories/_posts/2016-06-24-CVE-2016-5697.md b/advisories/_posts/2016-06-24-CVE-2016-5697.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: ! 'CVE-2016-5697: XML signature wrapping attack'
+comments: false
+categories:
+- ruby-saml
+advisory:
+  gem: ruby-saml
+  cve: 2016-5697
+  url: https://github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995
+  title: XML signature wrapping attack
+  date: 2016-06-24
+  description: ! 'ruby-saml prior to version 1.3.0 is vulnerable to an XML signature
+    wrapping attack
+
+    in the specific scenario where there was a signature that referenced at the same
+    time
+
+    2 elements (but past the scheme validator process since 1 of the element was inside
+
+    the encrypted assertion).
+
+
+    ruby-saml users must update to 1.3.0, which implements 3 extra validations to
+
+    mitigate this kind of attack.
+
+'
+  cvss_v3: 6.1
+  patched_versions:
+  - ! '>= 1.3.0'
+---
