CVE-2016-9814
CriticalSummary
The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.
Risk Assessment
Organizations may be exposed to attacks that could lead to credential spoofing or resource exhaustion, potentially resulting in service availability interruptions.
Recommendation
It is recommended to upgrade SimpleSAMLphp to version 1.14.10 or later and the simplesamlphp/saml2 library to version 1.9.1, 1.10.3, or 2.3.3 to mitigate this vulnerability.
Original NVD description (English source)
The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.