GitLab naprawia podatności związane z biblioteką ruby-saml

GitLab ogłosił wydanie nowych wersji oprogramowania. Aktualizacja dotyczy zarówno Community Edition, jak i Enterprise Edition. Poprawione wersje to  17.9.2, 17.8.5 oraz 17.7.7. Najważniejsza poprawka dotyczy dwóch podatności (CVE-2025-25291, CVE-2025-25292), zgłoszonych w bibliotece ruby-saml, która jest wykorzystywana przez GitLab do SAML SSO (security assertion markup language; single sign-on). W pewnych okolicznościach...

#WBiegu #Cve #Gitlab #Graphql #Podatności #Rce #Ruby #Saml

https://sekurak.pl/gitlab-naprawia-podatnosci-zwiazane-z-biblioteka-ruby-saml/

another lunchtime update, while I'm taking a break from doing #SAML updates. 4.3.6 #mastoadmin

GitLab Addresses Critical Security Flaws: A Deep Dive into Recent Vulnerabilities

GitLab has released crucial updates to patch nine vulnerabilities, including two critical authentication bypass issues in the ruby-saml library. This article explores the implications of these vulnera...

https://news.lavx.hu/article/gitlab-addresses-critical-security-flaws-a-deep-dive-into-recent-vulnerabilities

If you run #gitlab with #SAML authentication, you better upgrade as soon as possible

https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/

Nous avons eu le plaisir de participer aujourd'hui à l'enregistrement d'un épisode du Podcast "Tout est sous CTRL" produit par nos amis de Centreon.

Interviewé par Vincent Untz , @clementoudot est venu parler de gestion des identités et des accès (IAM), d'authentification mutli-facteurs (2FA/MFA) et de PasswordLess, mais surtout d'Open Source !

@ow2 @opensource_experts @fsfe

USSO is a third-party cookie-based SSO (for now), built to work across multiple domains and businesses. It has been in development for over a year by Mahdi Kiani.

Right now, it's written in Python, but a Go rewrite is coming soon. After the rewrite, OAuth, SAML, and other authentication methods will be added.

For now, USSO doesn’t have a frontend to manage all SSO operations, but everything is available through an API.

A couple of microservices also work with USSO:

A global S3-based file manager

UFAAS, a Function-as-a-Service platform, optimized for Iran

UFAAS currently only supports IRT/IRR currencies and integrates with Iranian payment gateways, but accounts can also be manually charged.

A Rust module for USSO has also been released, making it easier to integrate with Rust-based applications. Additionally, I've recently joined the development team.

USSO is planned to be used on Parch Linux, and detailed deployment documentation will be written for all major platforms, including cloud, Docker, Kubernetes, and Jails.

Mahdi Kiani on X: https://x.com/mahdikiani
Project GitHub: https://github.com/ussoio
The File Manager: https://github.com/ufilesorg
FaaS: https://github.com/ufaasio
profile manager based on usso: https://github.com/uprofile
rustcrate: https://crates.io/crates/usso

One day I will learn enough about #SAML

Could we please, please, PLEASE agree on /.well-known/saml/metadata.xml ? Yes?

At the last @univention summit I gave an introduction to the Keycloak app in Nubus. You missed it? There is a blog post now:

Navigating the Keycloak Admin Console with Nubus: A Step-by-Step Introduction

https://www.univention.com/blog-en/2024/10/navigating-the-keycloak-admin-console/

Auf dem @univention Summit hatte ich eine Einführung in die Bedienung der Keycloak-App auf Nubus gegeben. Das habe ich nun nochmal verbloggt, für alle, die es gerne nachlesen möchten:

Keycloak Admin Console mit Nubus: Der Einstieg leichtgemacht

https://www.univention.de/blog-de/2024/10/keycloak-admin-console/

#keycloak #nubus #univention @univention #singlesignon #oidc #saml

Dear Keycloak friends, I would love to hear if/how you use category-specific logging! What do you recommend to sysadmins interested in database + ldap interaction, caching, user events/errors, the user attributes that are actually sent to clients - without getting spammed with other things at the same time. Would you mind sharing your start settings for "--log-level"? Boosts welcome!

https://www.keycloak.org/server/logging#_configuring_category_specific_log_levels

Im Hinblick auf den Keycloak Identity Provider kann man sich übrigens bei openDesk schön angucken, wie die verschiedenen Clients angebunden sind. Der vorkonfigurierte Keycloak ist auch ein tolles Beispiel für eine möglichst datensparsame/gezielte Freigabe von Nutzerattributen an die angebundenen Anwendungen.

https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/raw/main/helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl

"Ruby-SAML pwned by XML signature wrapping attacks"

https://ssoready.com/blog/engineering/ruby-saml-pwned-by-xml-signature-wrapping-attacks/