Advisories for Composer/Onelogin/Php-Saml package

In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling openssl_verify() depending on the signature algorithm used. The openssl_verify() function returns 1 when the signature was successfully verified, 0 if it failed to verify with the given key, and -1 in case an error occurs. PHP allows translating numerical values to boolean implicitly, with …

An error during signature verification can be treated as a successful verification.

An error during signature verification can be treated as a successful verification.

Vulnerability to Response Wrapping attacks resulting in a malicious user gaining unauthorized access to a system.