{"metadata": {"vulnerability": "cve-2025-25292", "count": 81, "kinds": {"milestone": 11, "sighting": 42, "kev": 0, "other": 28}}, "data": [{"timestamp": "2025-02-06T17:13:33.122Z", "date_only": false, "value": "2025-02-06T17:13:33.122Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2025-25292", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-02-25T15:15:00Z", "date_only": false, "value": "2025-02-25T15:15:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0087", "record": "NCSC-2025-0087", "field": "document.tracking.generator.date"}, {"timestamp": "2025-03-12T00:00:00Z", "date_only": true, "value": "2025-03-12", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0205", "record": "CERTFR-2025-AVI-0205", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2025-03-12T20:07:18Z", "date_only": false, "value": "2025-03-12T20:07:18.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials/", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "493742b1-7a59-471f-b5fa-659e22aa7770", "url": "https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials/"}, {"timestamp": "2025-03-12T20:53:24.353Z", "date_only": false, "value": "2025-03-12T20:53:24.353Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-25292", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-03-12T20:54:42Z", "date_only": false, "value": "2025-03-12T20:54:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-754F-8GM6-C4R2", "record": "GHSA-754F-8GM6-C4R2", "field": "published"}, {"timestamp": "2025-03-12T21:15:00Z", "date_only": false, "value": "2025-03-12T21:15:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2025-25292", "record": "UBUNTU-CVE-2025-25292", "field": "published"}, {"timestamp": "2025-03-12T21:15:42Z", "date_only": false, "value": "2025-03-12T21:15:42Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-754F-8GM6-C4R2", "record": "GHSA-754F-8GM6-C4R2", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-03-12T21:15:42.177Z", "date_only": false, "value": "2025-03-12T21:15:42.177", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-25292", "record": "FKIE_CVE-2025-25292", "field": "published"}, {"timestamp": "2025-03-12T21:40:48Z", "date_only": false, "value": "2025-03-12T21:40:48.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/7388", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "b16772dc-8468-4d14-80d6-b8881d68b709", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-25292\n\ud83d\udd25 CVSS Score: 8.8 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P)\n\ud83d\udd39 Description: ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue.\n\ud83d\udccf Published: 2025-03-12T20:53:24.353Z\n\ud83d\udccf Modified: 2025-03-12T21:35:08.259Z\n\ud83d\udd17 References:\n1. https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-754f-8gm6-c4r2\n2. https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv\n3. https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9\n4. https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97\n5. https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released\n6. https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials\n7. https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4\n8. https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0", "url": "https://t.me/DarkWebInformer_CVEAlerts/7388"}, {"timestamp": "2025-03-12T23:00:00Z", "date_only": false, "value": "2025-03-12T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0549", "record": "WID-SEC-W-2025-0549", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-03-12T23:00:00Z", "date_only": false, "value": "2025-03-12T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0549", "record": "WID-SEC-W-2025-0549", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-03-12T23:00:00Z", "date_only": false, "value": "2025-03-12T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0549", "record": "WID-SEC-W-2025-0549", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2025-03-13T00:00:00Z", "date_only": false, "value": "2025-03-13T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0205", "record": "CERTFR-2025-AVI-0205", "field": "last_revision_date"}, {"timestamp": "2025-03-13T00:00:00Z", "date_only": false, "value": "2025-03-13T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0205", "record": "CERTFR-2025-AVI-0205", "field": "initial_release_date"}, {"timestamp": "2025-03-13T00:00:00Z", "date_only": false, "value": "2025-03-13T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0205", "record": "CERTFR-2025-AVI-0205", "field": "revisions.0.revision_date"}, {"timestamp": "2025-03-13T00:34:10Z", "date_only": false, "value": "2025-03-13T00:34:10.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/20176", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "4d5b0bbd-51c0-452f-b449-d54b6ff08e73", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-25292 - Apache Ruby SAML XML Parser Signature Wrapping Authentication Bypass\", \n  \"Content\": \"CVE ID : CVE-2025-25292 \nPublished : March 12, 2025, 9:15 p.m. | 2\u00a0hours, 8\u00a0minutes ago \nDescription : ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"13 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/20176"}, {"timestamp": "2025-03-13T05:57:30.908Z", "date_only": false, "value": "2025-03-13T05:57:30.908420Z", "kind": "sighting", "label": "Seen", "source": "https://vulnerability.circl.lu/bundle/788f36f8-de85-4779-b4e3-6815a156b903", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "354ca22f-9961-4b6d-a7c1-dfee0a5c1ecc", "url": "https://vulnerability.circl.lu/bundle/788f36f8-de85-4779-b4e3-6815a156b903"}, {"timestamp": "2025-03-13T06:45:02Z", "date_only": false, "value": "2025-03-13T06:45:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/tech_b0lt_Genona/5097", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "d05c6e2a-e298-4456-81b2-a88cbe7d08f7", "content": "\u041d\u0430\u0448\u0430 \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u0430\u044f \u0440\u0443\u0431\u0440\u0438\u043a\u0430\n\n\u041e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u043c \u0433\u0438\u0442\u043b\u0430\u0431\u0447\u0438\u043a\u0438 \ud83d\udc85\ud83d\udc85\ud83d\udc85\n\nGitLab has remediated two privately disclosed security issues (CVE-2025-25291, CVE-2025-25292) identified in the ruby-saml library which GitLab uses when SAML SSO authentication is enabled at the instance or group level. These issues have been remediated on GitLab.com, and in GitLab CE/EE versions 17.7.7, 17.8.5, and 17.9.2.\n\nOn GitLab CE/EE instances using SAML authentication, under certain circumstances, an attacker with access to a valid signed SAML document from the IdP could authenticate as another valid user within the environment's SAML IdP.\n\nSelf Managed GitLab: Known Mitigations\n\nAffected customers who cannot immediately update GitLab CE/EE to address these issues may choose to perform the following mitigation steps:\n\nNote: This vulnerability requires the attacker to have compromised a valid user account to perform the authentication bypass.\n\n- Enable GitLab two-factor authentication for all user accounts on the GitLab self-managed instance (NOTE: Enabling identity provider multi-factor authentication does not mitigate this vulnerability) and\n\n- Do not allow the SAML two-factor bypass option in GitLab and\n\n- Require admin approval for automatically created new users (gitlab_rails['omniauth_block_auto_created_users'] = true)\n\nhttps://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/", "url": "https://t.me/tech_b0lt_Genona/5097"}, {"timestamp": "2025-03-13T08:52:09.744Z", "date_only": false, "value": "2025-03-13T08:52:09.744909Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/decio/statuses/114154270169549367", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "2b1607b7-4200-443f-be26-8f8c022058a5", "url": "https://infosec.exchange/users/decio/statuses/114154270169549367"}, {"timestamp": "2025-03-13T11:18:39.021Z", "date_only": false, "value": "2025-03-13T11:18:39.021082Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/114154846152927799", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "ff1f92e6-0f7f-40e7-a7b8-1e0d97ee0cbf", "url": "https://infosec.exchange/users/cR0w/statuses/114154846152927799"}, {"timestamp": "2025-03-13T11:19:56.631Z", "date_only": false, "value": "2025-03-13T11:19:56.631399Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/114154851252724733", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "c596b94d-cd52-4a0b-9068-9249d78f2192", "url": "https://infosec.exchange/users/cR0w/statuses/114154851252724733"}, {"timestamp": "2025-03-13T11:24:09.298Z", "date_only": false, "value": "2025-03-13T11:24:09.298419Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/114154867825552089", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "67cac3eb-d1e3-41e3-9efa-ff3cb1e740a9", "url": "https://infosec.exchange/users/cR0w/statuses/114154867825552089"}, {"timestamp": "2025-03-13T13:34:43Z", "date_only": false, "value": "2025-03-13T13:34:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/6486", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "ce457868-c17e-4657-8e69-79f793dda503", "content": "\ud83d\udd34 ruby-saml Flaws Open SAML Auth to Hijacking\n\nGitHub Security Lab found CVE-2025-25291 & CVE-2025-25292 (CVSS 8.8) in ruby-saml, allowing attackers to bypass authentication using a valid signature.\n\n\ud83d\udd17 Read: https://thehackernews.com/2025/03/github-uncovers-new-ruby-saml.html\n\n\ud83d\udd11 Update now or risk account takeover.", "url": "https://t.me/thehackernews/6486"}, {"timestamp": "2025-03-13T13:44:56Z", "date_only": false, "value": "2025-03-13T13:44:56.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/WNRbuXq55OVE9Qh-wm0yqD8L1Jchj4VgDMTY-oahDGw04g", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "929ecaf0-3534-49e5-b2fe-551f482fc621"}, {"timestamp": "2025-03-13T17:22:59Z", "date_only": false, "value": "2025-03-13T17:22:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberBulletin/2618", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "dec9eb49-61fc-4bdc-ab32-6af69210d3e2", "content": "\u26a1ruby-saml Flaws Open SAML Auth to Hijacking\n\nGitHub Security Lab found CVE-2025-25291 & CVE-2025-25292 (CVSS 8.8) in ruby-saml, allowing attackers to bypass authentication using a valid signature.\n\n#CyberBulletin", "url": "https://t.me/CyberBulletin/2618"}, {"timestamp": "2025-03-13T23:00:00Z", "date_only": false, "value": "2025-03-13T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0549", "record": "WID-SEC-W-2025-0549", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2025-03-13T23:00:00Z", "date_only": false, "value": "2025-03-13T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0561", "record": "WID-SEC-W-2025-0561", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-03-13T23:00:00Z", "date_only": false, "value": "2025-03-13T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0561", "record": "WID-SEC-W-2025-0561", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-03-13T23:00:00Z", "date_only": false, "value": "2025-03-13T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0561", "record": "WID-SEC-W-2025-0561", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2025-03-14T09:12:21.970Z", "date_only": false, "value": "2025-03-14T09:12:21.970246Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/dimaiosdev.bsky.social/post/3lkdbeyncf22c", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "25017d8b-3235-48ee-a50a-1e3d5e1c31ed", "url": "https://bsky.app/profile/dimaiosdev.bsky.social/post/3lkdbeyncf22c"}, {"timestamp": "2025-03-14T09:14:59.775Z", "date_only": false, "value": "2025-03-14T09:14:59.775984Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2025-0087", "record": "NCSC-2025-0087", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-03-14T09:14:59.775Z", "date_only": false, "value": "2025-03-14T09:14:59.775984Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2025-0087", "record": "NCSC-2025-0087", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-03-14T09:14:59.775Z", "date_only": false, "value": "2025-03-14T09:14:59.775984Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0087", "record": "NCSC-2025-0087", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-03-14T10:05:19Z", "date_only": false, "value": "2025-03-14T10:05:19.000000Z", "kind": "sighting", "label": "Seen", "source": "https://threatintel.cc/2025/03/14/gitlab-addressed-critical-auth-bypass.html", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "4984eec6-5c77-4f6e-b377-b0fe6c01be4f", "url": "https://threatintel.cc/2025/03/14/gitlab-addressed-critical-auth-bypass.html"}, {"timestamp": "2025-03-14T16:15:03.829Z", "date_only": false, "value": "2025-03-14T16:15:03.829500Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3lkdyyts5z62u", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "84fbea79-b4a0-4396-aa88-ad26e17e2a8d", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3lkdyyts5z62u"}, {"timestamp": "2025-03-14T21:37:07Z", "date_only": false, "value": "2025-03-14T21:37:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberBulletin/2634", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "566c11e0-455e-4546-b575-5354f6e2e1ee", "content": "\u26a1Account hijacking possible with ruby-saml library bugs.\n\nTracked as CVE-2025-25291 and CVE-2025-25292, which could be exploited to circumvent the authentication defenses of the Security Assertion Markup Language and facilitate account takeovers.\n\n#CyberBulletin", "url": "https://t.me/CyberBulletin/2634"}, {"timestamp": "2025-03-14T22:06:12.948Z", "date_only": false, "value": "2025-03-14T22:06:12.948944Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lkemmpsaus2o", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "841854be-14c5-407a-8b5f-4b10473bfdc9", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lkemmpsaus2o"}, {"timestamp": "2025-03-15T06:09:33.166Z", "date_only": false, "value": "2025-03-15T06:09:33.166085Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/saveam.bsky.social/post/3lkfhdaabxl23", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "9d2cc90e-8fba-465a-844c-d8e61db44e38", "url": "https://bsky.app/profile/saveam.bsky.social/post/3lkfhdaabxl23"}, {"timestamp": "2025-03-15T06:09:33.755Z", "date_only": false, "value": "2025-03-15T06:09:33.755477Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/saveam.bsky.social/post/3lkfhdaaevd23", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "55d4620f-d54e-4f09-b414-079be80192d0", "url": "https://bsky.app/profile/saveam.bsky.social/post/3lkfhdaaevd23"}, {"timestamp": "2025-03-15T06:09:34.350Z", "date_only": false, "value": "2025-03-15T06:09:34.350189Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/saveam.bsky.social/post/3lkfhdaaful23", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "e180fcfc-4db3-4665-b80e-50322cf30804", "url": "https://bsky.app/profile/saveam.bsky.social/post/3lkfhdaaful23"}, {"timestamp": "2025-03-15T06:09:34.911Z", "date_only": false, "value": "2025-03-15T06:09:34.911598Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/saveam.bsky.social/post/3lkfhdaafum23", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "3f8cbcb7-0d13-468e-b225-0f945375d0cf", "url": "https://bsky.app/profile/saveam.bsky.social/post/3lkfhdaafum23"}, {"timestamp": "2025-03-15T06:09:35.501Z", "date_only": false, "value": "2025-03-15T06:09:35.501231Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/saveam.bsky.social/post/3lkfhdaafun23", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "be5c76ee-6802-45a5-8ec0-8140022c8864", "url": "https://bsky.app/profile/saveam.bsky.social/post/3lkfhdaafun23"}, {"timestamp": "2025-03-15T13:31:12.378Z", "date_only": false, "value": "2025-03-15T13:31:12.378264Z", "kind": "sighting", "label": "Seen", "source": "https://mstdn.ca/users/rfwaveio/statuses/114166691630661888", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "ba73a985-5f67-437d-9336-5fb968029880", "url": "https://mstdn.ca/users/rfwaveio/statuses/114166691630661888"}, {"timestamp": "2025-03-15T14:47:01Z", "date_only": false, "value": "2025-03-15T14:47:01.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/itsec_news/5499", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "0d796a8e-e457-4f22-a23b-56b3ef6fd5a2", "content": "\u200b\u26a1\ufe0f\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 ruby-saml \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e: \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0433\u0440\u043e\u0436\u0430\u044e\u0442 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\ud83d\udcac \u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 ruby-saml, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0439 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u043c Security Assertion Markup Language (SAML), \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u042d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0436\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\nSAML \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u0435\u0436\u0434\u0443 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0435\u0434\u0438\u043d\u043e\u0436\u0434\u044b \u0432\u0445\u043e\u0434\u0438\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 (SSO) \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c \u0431\u0435\u0437 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0433\u043e \u0432\u0432\u043e\u0434\u0430 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u041e\u0434\u043d\u0430\u043a\u043e \u0432 \u043a\u043e\u0434\u0435 ruby-saml \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u043f\u043e\u0434\u0434\u0435\u043b\u044b\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0414\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0435 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b CVE-2025-25291 \u0438 CVE-2025-25292 , \u0438\u043c\u0435\u044e\u0442 \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 CVSS \u2014 8.8 \u0438\u0437 10. \u041e\u043d\u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u043c\u043b\u0430\u0434\u0448\u0435 1.12.4, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043e\u0442 1.13.0 \u0434\u043e 1.18.0 (\u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e).\n\n\u041f\u0440\u0438\u0447\u0438\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u0438\u044f\u0445 \u043c\u0435\u0436\u0434\u0443 \u043f\u0430\u0440\u0441\u0435\u0440\u0430\u043c\u0438 XML REXML \u0438 Nokogiri, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e-\u0440\u0430\u0437\u043d\u043e\u043c\u0443 \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0438\u0440\u0443\u044e\u0442 \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 XML-\u043a\u043e\u0434. \u042d\u0442\u043e \u0440\u0430\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 Signature Wrapping, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 GitHub \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043d\u043e\u044f\u0431\u0440\u0435 2024 \u0433\u043e\u0434\u0430. \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438, \u0447\u0442\u043e \u044d\u0442\u0438 \u043e\u0448\u0438\u0431\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u0445\u0432\u0430\u0442\u0443 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435, \u043e\u0431\u043b\u0430\u0434\u0430\u044f \u043e\u0434\u043d\u043e\u0439 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043b\u044e\u0447\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 SAML-\u043e\u0442\u0432\u0435\u0442\u043e\u0432 \u0438\u043b\u0438 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0439, \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u0434\u0434\u0435\u043b\u044b\u0432\u0430\u0442\u044c SAML-\u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 1.12.4 \u0438 1.18.0 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 ( CVE-2025-25293 , CVSS 7.7), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0442\u043a\u0430\u0437\u043e\u043c \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 (DoS). \u041e\u043d\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u0436\u0430\u0442\u044b\u0445 SAML-\u043e\u0442\u0432\u0435\u0442\u043e\u0432 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0434\u0435\u0441\u0442\u0430\u0431\u0438\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432.\n\n\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 GitHub \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043a\u043e\u0440\u0435\u043d\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u2014 \u043d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0445\u0435\u0448\u0430 \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u0447\u0442\u043e \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u043d\u0438\u0446\u0443 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 XML-\u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c ruby-saml \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0447\u0442\u043e\u0431\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u0440\u0438\u0441\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0420\u0430\u043d\u0435\u0435, \u0432 2024 \u0433\u043e\u0434\u0443, GitLab \u0438 ruby-saml \u0443\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0431\u0430\u0433 ( CVE-2024-45409 , CVSS 10.0), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\ud83d\udd14 ITsec NEWS", "url": "https://t.me/itsec_news/5499"}, {"timestamp": "2025-03-16T01:33:24.731Z", "date_only": false, "value": "2025-03-16T01:33:24.731785Z", "kind": "sighting", "label": "Seen", "source": "https://mstdn.ca/users/rfwaveio/statuses/114169531613827594", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "aa9fd3b8-a3f0-4112-9b27-e31d113df25e", "url": "https://mstdn.ca/users/rfwaveio/statuses/114169531613827594"}, {"timestamp": "2025-03-16T23:34:06.856Z", "date_only": false, "value": "2025-03-16T23:34:06.856306Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-3e39154e-7e52655bd7735e43", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "92476218-dd79-4426-a071-fdf2b09afaa9", "url": "https://poliverso.org/objects/0477a01e-3e39154e-7e52655bd7735e43"}, {"timestamp": "2025-03-17T10:25:26.506Z", "date_only": false, "value": "2025-03-17T10:25:26.506754Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/tomcat/statuses/114177286203783922", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "abf77c9a-5c76-4703-b6c9-bf5bfb9338c6", "url": "https://infosec.exchange/users/tomcat/statuses/114177286203783922"}, {"timestamp": "2025-03-17T19:58:15.419Z", "date_only": false, "value": "2025-03-17T19:58:15.419997Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lklwuqfadg2x", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "cbcffebe-5ebd-4931-aa2f-6413418e44dd", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3lklwuqfadg2x"}, {"timestamp": "2025-03-18T14:32:48.636Z", "date_only": false, "value": "2025-03-18T14:32:48.636527Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-25292", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2025-03-18T14:32:48.636Z", "date_only": false, "value": "2025-03-18T14:32:48.636527Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-25292", "record": "FKIE_CVE-2025-25292", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-03-18T14:32:54.612Z", "date_only": false, "value": "2025-03-18T14:32:54.612Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-25292", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-18T15:47:03.743Z", "date_only": false, "value": "2025-03-18T15:47:03.743643Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3lknzchpnnd2u", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "424e47dd-df43-4f97-b3d9-2911b61b29b9", "url": "https://bsky.app/profile/buherator.bsky.social/post/3lknzchpnnd2u"}, {"timestamp": "2025-03-18T20:58:48.188Z", "date_only": false, "value": "2025-03-18T20:58:48.188575Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokpweols2m", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "35274da9-a9d9-4323-abe3-2c35518de588", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokpweols2m"}, {"timestamp": "2025-03-18T20:59:06.302Z", "date_only": false, "value": "2025-03-18T20:59:06.302497Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokqdygp32r", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "c09423c2-f348-4605-826e-fe2c4d2ee970", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokqdygp32r"}, {"timestamp": "2025-03-18T20:59:31.504Z", "date_only": false, "value": "2025-03-18T20:59:31.504117Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokr7tm7l2u", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "a9f6788c-c369-49c6-9803-200b648d8b47", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokr7tm7l2u"}, {"timestamp": "2025-03-18T21:01:39.605Z", "date_only": false, "value": "2025-03-18T21:01:39.605882Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokuzqx2e2r", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "35cc35c6-78ea-4db4-ab9b-b25189e53956", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokuzqx2e2r"}, {"timestamp": "2025-03-18T21:02:07.870Z", "date_only": false, "value": "2025-03-18T21:02:07.870130Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokvurocj2k", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "70955c5c-6c72-4a77-b624-caf4fd167175", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokvurocj2k"}, {"timestamp": "2025-03-18T21:03:11.019Z", "date_only": false, "value": "2025-03-18T21:03:11.019487Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokxqvjot2k", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "567888c2-2fb4-425b-9798-02f394c5f159", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokxqvjot2k"}, {"timestamp": "2025-03-18T21:03:36.332Z", "date_only": false, "value": "2025-03-18T21:03:36.332597Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokyjc4f22u", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "fc883dc0-b986-4f1a-b57d-2201bb161378", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3lkokyjc4f22u"}, {"timestamp": "2025-03-18T21:28:16.210Z", "date_only": false, "value": "2025-03-18T21:28:16.210942Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lkomemcicw2k", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "bf3a54a6-462b-456c-8247-7678e1f3fea7", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3lkomemcicw2k"}, {"timestamp": "2025-03-25T00:46:04Z", "date_only": false, "value": "2025-03-25T00:46:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ton618cyber/8022", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "e2d17c83-b5c7-4de1-b678-7da84c74b87f", "content": "GitHub Uncovers New ruby-saml Vulnerabilities Allowing Account Takeover Attacks\n\nruby-saml vulnerabilities (CVE-2025-25291, CVE-2025-25292) allow SAML authentication bypass (CVSS 8.8). Update to versions 1.12.4 or 1.18.0 now.\n\nThe Hacker News | thehackernews.com \u2022 Mar 13, 2025", "url": "https://t.me/ton618cyber/8022"}, {"timestamp": "2025-03-25T00:46:05Z", "date_only": false, "value": "2025-03-25T00:46:05.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ton618cyber/3203", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "7e8329d0-5fa4-49bb-b030-884eaafe909f", "content": "GitHub Uncovers New ruby-saml Vulnerabilities Allowing Account Takeover Attacks\n\nruby-saml vulnerabilities (CVE-2025-25291, CVE-2025-25292) allow SAML authentication bypass (CVSS 8.8). Update to versions 1.12.4 or 1.18.0 now.\n\nThe Hacker News | thehackernews.com \u2022 Mar 13, 2025", "url": "https://t.me/ton618cyber/3203"}, {"timestamp": "2025-04-02T22:00:00Z", "date_only": false, "value": "2025-04-02T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0561", "record": "WID-SEC-W-2025-0561", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2025-04-06T22:00:00Z", "date_only": false, "value": "2025-04-06T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0561", "record": "WID-SEC-W-2025-0561", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2025-04-06T22:00:00Z", "date_only": false, "value": "2025-04-06T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0561", "record": "WID-SEC-W-2025-0561", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-04-07T10:05:18.614Z", "date_only": false, "value": "2025-04-07T10:05:18.614+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0561", "record": "WID-SEC-W-2025-0561", "field": "document.tracking.generator.date"}, {"timestamp": "2025-04-14T11:55:19.936Z", "date_only": false, "value": "2025-04-14T11:55:19.936Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-GITLAB-2025-25292", "record": "BIT-GITLAB-2025-25292", "field": "published"}, {"timestamp": "2025-08-03T22:00:00Z", "date_only": false, "value": "2025-08-03T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0549", "record": "WID-SEC-W-2025-0549", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2025-08-03T22:00:00Z", "date_only": false, "value": "2025-08-03T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0549", "record": "WID-SEC-W-2025-0549", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-08-04T11:05:29.494Z", "date_only": false, "value": "2025-08-04T11:05:29.494+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0549", "record": "WID-SEC-W-2025-0549", "field": "document.tracking.generator.date"}, {"timestamp": "2025-09-12T19:06:17.813Z", "date_only": false, "value": "2025-09-12T19:06:17.813Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2025-25292", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-11-03T19:45:01.139Z", "date_only": false, "value": "2025-11-03T19:45:01.139Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2025-25292", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-11-03T19:45:01.139Z", "date_only": false, "value": "2025-11-03T19:45:01.139Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2025-25292", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-11-03T21:33:11Z", "date_only": false, "value": "2025-11-03T21:33:11Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-754F-8GM6-C4R2", "record": "GHSA-754F-8GM6-C4R2", "field": "modified"}, {"timestamp": "2025-12-09T21:51:55.557Z", "date_only": false, "value": "2025-12-09T21:51:55.557434Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3m7ljpqhxj225", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "84af3b9f-2f00-475e-8dba-a76f15019f08", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3m7ljpqhxj225"}, {"timestamp": "2026-01-20T05:27:22Z", "date_only": false, "value": "2026-01-20T05:27:22Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2025-25292", "record": "UBUNTU-CVE-2025-25292", "field": "modified"}, {"timestamp": "2026-06-17T09:00:37.750Z", "date_only": false, "value": "2026-06-17T09:00:37.750", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-25292", "record": "FKIE_CVE-2025-25292", "field": "lastModified"}, {"timestamp": "2026-07-25T15:00:15.355Z", "date_only": false, "value": "2026-07-25T15:00:15.355099Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ZerodayAlert/445", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "7d291af3-fd06-497f-a85c-3c250929cf77", "url": "https://t.me/ZerodayAlert/445"}, {"timestamp": "2026-07-26T00:00:13.612Z", "date_only": false, "value": "2026-07-26T00:00:13.612356Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ZerodayAlert/445", "record": "CVE-2025-25292", "field": "creation_timestamp", "uuid": "c29eec1d-ebb0-4252-89ce-04ed2069632a", "url": "https://t.me/ZerodayAlert/445"}, {"timestamp": "2026-09-08T08:34:36.952Z", "date_only": false, "value": "2026-09-08T08:34:36.952Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-GITLAB-2025-25292", "record": "BIT-GITLAB-2025-25292", "field": "modified"}]}