Improper signature verification in Rob Richards XmlSecLibs
Priority MEDIUM 43CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.
Why it matters now
EPSS 0.02988 87th percentileScored 2026-11-07
Fix Fixed robrichards/xmlseclibs (Packagist): 3.0.4, 2.1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Rob Richards XmlSecLibs | All versions prior to version 3.0.3 | — | No fix listed | CNA |
| — | robrichards/xmlseclibs (Packagist) | 3.0.0 to before 3.0.4 | 3.0.4 | Patch available | GHSA-pqm6-cgwr-x6pf |
| — | robrichards/xmlseclibs (Packagist) | 1.0.0 to before 2.1.1 | 2.1.1 | Patch available | GHSA-pqm6-cgwr-x6pf |
- Rob Richards XmlSecLibs Vendor— Affected All versions prior to version 3.0.3 Fixed in — No fix listed CNA
- robrichards/xmlseclibs (Packagist) Vendor— Affected 3.0.0 to before 3.0.4 Fixed in 3.0.4 Patch available GHSA-pqm6-cgwr-x6pf
- robrichards/xmlseclibs (Packagist) Vendor— Affected 1.0.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-pqm6-cgwr-x6pf
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xmlseclibs_project:xmlseclibs:*:*:*:*:*:*:*:* | 1.0.0 – 1.4.2; 2.0.0 – 2.1.0; 3.0.0 – 3.0.3 | Vulnerable | Xmlseclibs Project |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:* | up to 1.17.6 | Vulnerable | simplesamlphp |
- cpe:2.3:a:xmlseclibs_project:xmlseclibs:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.4.2; 2.0.0 – 2.1.0; 3.0.0 – 3.0.3 Vulnerable ·Xmlseclibs Project
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:* Versions up to 1.17.6 Vulnerable ·simplesamlphp
Remediation
- Fix · GHSA-pqm6-cgwr-x6pf robrichards/xmlseclibs (Packagist) Fixed in 3.0.4 Advisory →
- Fix · GHSA-pqm6-cgwr-x6pf robrichards/xmlseclibs (Packagist) Fixed in 2.1.1 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3465
- 2026-10-03 Alias added: GHSA-pqm6-cgwr-x6pf
References
Advisory 14
- [debian-lts-announce] 20191106 [SECURITY] [DLA 1983-1] simplesamlphp security update
- 20191106 [SECURITY] [DSA 4560-1] simplesamlphp security update
- DSA-4560
- https://simplesamlphp.org/security/201911-01
- FEDORA-2019-9a960c8a98
- FEDORA-2019-81f61cdceb
- FEDORA-2019-be01267416
- FEDORA-2019-73d0fe1d15
- FEDORA-2019-dc90bf093b
- FEDORA-2019-ec8719a21c
- FEDORA-2020-1b95d7a131
- FEDORA-2020-46d0f456a9
- FEDORA-2020-af82229ae5
- https://nvd.nist.gov/vuln/detail/CVE-2019-3465
Other 11
- https://www.tenable.com/security/tns-2019-09
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XBSSRV5Q7JFCYO46A3EN624UZ4KXFQ2M
- https://lists.fedoraproject.org/archives/list/[email protected]/message/OCSR3V6LNWJAD37VQB6M2K7P4RQSCVFG
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MAWOVYLZKYDCQBLQEJCFAAD3KQTBPHXE
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HBE2SJSXG7J4XYLJ2H6HC2VPPOG2OMUN
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ESKJTWLE7QZBQ3EKMYXKMBQG3JDEJWM6
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BNFMY5RRLU63P25HEBVDO5KAVI7TX7JV
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BBKVDUZ7G5ZOUO4BFJWLNJ6VOKBQJX5U
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AB34ILMJ67CUROBOR6YPKB46VHXLOAJ4
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7KID7C4AZPYYIZQIPSLANP4R2RQR6YK3
- https://github.com/FriendsOfPHP/security-advisories/blob/master/robrichards/xmlseclibs/CVE-2019-3465.yaml
Sources
- CVE-2019-3465 · CVE Program
- CVE-2019-3465 · NVD
- FIRST EPSS
- GHSA-pqm6-cgwr-x6pf · GitHub Advisory Database · CC BY 4.0
- CVE-2019-3465 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences