blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2017-12868

CRITICAL 9.8 CVSS 3.0
Published
September 1, 2017
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-384
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.

References

  • github.com https://github.com/simplesamlphp/simplesamlphp/commit/4bc629658e7b7d17c9ac3fe0da7dc5df71f1b85e Issue Tracking, Patch, Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2018/06/msg00017.html
  • simplesamlphp.org https://simplesamlphp.org/security/201705-01 Patch, Vendor Advisory
  • nvd.nist.gov Official NVD record