GCVE - cpe:2.3:a:simplesamlphp:xml-security:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:simplesamlphp:xml-security:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Simplesamlphp (`723eef35-1c24-5d77-a217-2d432eb087cb`)
Product	Xml Security (`2701e16a-9095-5787-857a-fb883e580c5e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:composer/simplesamlphp/xml-security`	purl2cpe	2026-06-01 10:15:25.599454
`pkg:github/simplesamlphp/xml-security`	purl2cpe	2026-06-01 10:15:25.599456

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-32600`	vulnerable	2026-06-08 07:57:17.734841	xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption HIGH (8.2) xml-security is a library that implements XML signatures and encryption. Prior to versions 2.3.1 and 1.13.9, XML nodes encrypted with either aes-128-gcm, aes-192-gcm, or aes-256-gcm lack validation of the authentication tag length. An attacker can use this to brute-force an authentication tag, recover the GHASH key, and decrypt the encrypted nodes. It also allows to forge arbitrary ciphertexts without knowing the encryption key. This vulnerability is fixed in 2.3.1 and 1.13.9. Published: 2026-03-13T19:58:41.692Z Updated: 2026-03-16T14:03:17.811Z Open on db.gcve.eu Reference links https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-r353-4845-pr5p https://github.com/simplesamlphp/xml-security/commit/cad6d57cf0a5a0b7e0cc4e4a5b18752e56eb1520 https://github.com/simplesamlphp/xml-security/commit/fdc12449e959c610943f9fd428e95e3832d74c25	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-49087`	vulnerable	2026-06-08 06:14:28.403722	Validation of SignedInfo MEDIUM (6.8) xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13. Published: 2023-11-30T05:20:28.298Z Updated: 2024-08-02T21:46:29.195Z Open on db.gcve.eu Reference links https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6r https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b5122317287581	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.