Ubuntu Security Notices
USN-7364-1

USN-7364-1: OpenSAML vulnerability

Publication date

21 March 2025

Overview

OpenSAML and OpenSAML2 could have their authentication systems bypassed.

Releases

25.04 24.10 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS

Packages

opensaml - Security Assertion Markup Language library (development)
opensaml2 - Security Assertion Markup Language library (development)

Details

Alexander Tan discovered that the OpenSAML C++ library was susceptible to
forging of signed SAML messages. An attacker could possibly use this issue
to gain unauthorized access to a system and manipulate sensitive
information.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
25.04 plucky	libsaml-dev – 3.3.0-2ubuntu1
	libsaml13 – 3.3.0-2ubuntu1
	opensaml-schemas – 3.3.0-2ubuntu1
	opensaml-tools – 3.3.0-2ubuntu1
24.10 oracular	libsaml-dev – 3.2.1-4.1ubuntu0.24.10.1
	libsaml12t64 – 3.2.1-4.1ubuntu0.24.10.1
	opensaml-schemas – 3.2.1-4.1ubuntu0.24.10.1
	opensaml-tools – 3.2.1-4.1ubuntu0.24.10.1
24.04 noble	libsaml-dev – 3.2.1-4.1ubuntu0.24.04.1
	libsaml12t64 – 3.2.1-4.1ubuntu0.24.04.1
	opensaml-schemas – 3.2.1-4.1ubuntu0.24.04.1
	opensaml-tools – 3.2.1-4.1ubuntu0.24.04.1
22.04 jammy	libsaml-dev – 3.2.1-1ubuntu0.1
	libsaml12 – 3.2.1-1ubuntu0.1
	opensaml-schemas – 3.2.1-1ubuntu0.1
	opensaml-tools – 3.2.1-1ubuntu0.1
20.04 focal	libsaml-dev – 3.0.1-1ubuntu0.1
	libsaml10 – 3.0.1-1ubuntu0.1
	opensaml-schemas – 3.0.1-1ubuntu0.1
	opensaml-tools – 3.0.1-1ubuntu0.1
18.04 bionic	libsaml2-dev – 2.6.1-1ubuntu0.1~esm1
	libsaml9 – 2.6.1-1ubuntu0.1~esm1
	opensaml2-schemas – 2.6.1-1ubuntu0.1~esm1
	opensaml2-tools – 2.6.1-1ubuntu0.1~esm1
16.04 xenial	libsaml2-dev – 2.5.5-1ubuntu0.1+esm1
	libsaml8v5 – 2.5.5-1ubuntu0.1+esm1
	opensaml2-schemas – 2.5.5-1ubuntu0.1+esm1
	opensaml2-tools – 2.5.5-1ubuntu0.1+esm1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

https://launchpad.net/bugs/2103420