Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2024-45409: The Ruby SAML library is for implementing the client side of a SAML authorization

64
This week
CRITICAL 10.0REMOTEUPGRADEUPGRADEUPGRADE

CVE-2024-45409 is a critical-severity flaw (CVSS 10.0) affecting ruby-saml, omniauth saml, gitlab. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed i

Why this priority

  • Critical severity
  • EPSS top 4%: very likely to be exploited
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score10.0 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance10.7% (top 4%)
CISA exploited listNo
WeaknessCWE-347
Published2024-09-10
Last modified2026-06-17
Publisher (CNA): GitHub, Inc. · Vendor: gitlab · omniauth · onelogin

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

onelogin ruby-saml UPGRADE
Affected: < 1.12.3 · >= 1.13.0 and < 1.17.0
Fixed in: 1.12.3, 1.17.0
Safe to downgrade to: a release before 1.13.0
1. Check installed version
apt-cache policy ruby-saml || rpm -q ruby-saml || ruby-saml --version
2. UPGRADE to 1.12.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade ruby-saml
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade ruby-saml
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.13.0 (Debian / Ubuntu)
apt-cache madison ruby-saml sudo apt install ruby-saml=<VERSION_BEFORE_1.13.0> sudo apt-mark hold ruby-saml
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list ruby-saml sudo dnf downgrade ruby-saml-<VERSION_BEFORE_1.13.0> sudo dnf versionlock add ruby-saml
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
omniauth omniauth saml UPGRADE
Affected: <= 1.10.3 · 2.0.0 · 2.1.0
Fixed in: newer than 1.10.3
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy omniauth-saml || rpm -q omniauth-saml || omniauth-saml --version
2. UPGRADE to newer than 1.10.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade omniauth-saml
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade omniauth-saml
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
gitlab gitlab UPGRADE
Affected: < 16.11.10 · >= 17.0.0 and < 17.0.8 · >= 17.1.0 and < 17.1.8 · >= 17.2.0 and < 17.2.7 · >= 17.3.0 and < 17.3.3
Fixed in: 16.11.10, 17.0.8, 17.1.8, 17.2.7, 17.3.3
Safe to downgrade to: a release before 17.0.0
1. Check installed version
apt-cache policy gitlab || rpm -q gitlab || gitlab --version
2. UPGRADE to 16.11.10 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade gitlab
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade gitlab
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 17.0.0 (Debian / Ubuntu)
apt-cache madison gitlab sudo apt install gitlab=<VERSION_BEFORE_17.0.0> sudo apt-mark hold gitlab
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list gitlab sudo dnf downgrade gitlab-<VERSION_BEFORE_17.0.0> sudo dnf versionlock add gitlab
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Advisories and coverage

Official advisories

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-45409?

ruby-saml: upgrade to 1.12.3, 1.17.0; omniauth saml: upgrade to newer than 1.10.3; gitlab: upgrade to 16.11.10, 17.0.8, 17.1.8, 17.2.7, 17.3.3. Exact commands for each OS are on this page.

Is CVE-2024-45409 being exploited?

CVE-2024-45409 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-45409 affect?

CVE-2024-45409 affects ruby-saml, omniauth saml, gitlab. Severity is critical (CVSS 10.0). The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed

How urgent is CVE-2024-45409?

Priority 64/100. Critical severity; EPSS top 4%: very likely to be exploited; Remotely exploitable, no login, no user action

Software pages

GitLab vulnerabilities · Ruby vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.