CVE-2017-12870

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions 1.14.12 and earlier

Description The issue makes it easier for man-in-the-middle attackers to obtain sensitive information. This is achieved by leveraging the use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-HTTPS service providers.

Recommendations For SimpleSAMLphp versions 1.14.12 and earlier, consider updating to a version that addresses this issue, as using non-HTTPS service providers with the current aesEncrypt and aesDecrypt methods poses a risk. As a temporary workaround, consider restricting the use of non-HTTPS service providers until a patch is available.