CVE-2025-31335

Publication date 28 March 2025

Last updated 28 March 2025

Ubuntu priority

The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatures).

Status

Show unmaintained releases

Package	Ubuntu Release	Status
opensaml	24.10 oracular	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation

How can I get the fixes?
What do statuses mean?

References

MITRE
NVD
Launchpad
Debian

Other references

https://www.cve.org/CVERecord?id=CVE-2025-31335
https://shibboleth.net/community/advisories/secadv_20250313.txt
https://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=22a610b322e2178abd03e97cdbc8fb50b45efaee (3.3.1)
https://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=22a610b322e2178abd03e97cdbc8fb50b45efaee
https://lists.debian.org/debian-security-announce/2025/msg00041.html
https://shibboleth.atlassian.net/browse/CPPOST-126