Claude Opus

**Name of the Vulnerable Software and Affected Versions** Relyra versions 1.0.0 through 1.1.0 **Description** Relyra is a SAML 2.0 Service Provider library for Elixir and Phoenix that accepts forged SAML signatures. This occurs because the `SignatureValue` is not cryptographically verified before the library returns a successful authentication result. The XMLDSig trust boundary is incomplete because `:public key.verify` over the exclusive-C14N canonicalized `SignedInfo` is not performed against the configured IdP certificate's public key, the `DigestValue` is not recomputed over the canonicalized referenced element, and the `canonicalize/2` function remains an unused passthrough in the signature-verification path. Consequently, a structure-only acceptance path exists where document shape and trust-source rejection can succeed without proving the signature bytes, allowing a forged `SignatureValue` containing an attacker-controlled `NameID` to be accepted as `{:ok}`. **Recommendations** Update to version 1.2.0.

**Name of the Vulnerable Software and Affected Versions** SolidCAM-GPPL-IDE versions 1.0.0 through 1.0.1 **Description** The `GpplDocumentLinkHandler` resolves the `filename` directive in GPPL postprocessor files into clickable links. The handler accepts arbitrary absolute, relative, UNC, and subfolder paths, calling `File.Exists` to determine if a link should be rendered. This allows for information disclosure through path probing and NTLM hash leaks via UNC path probing. **Recommendations** Update to version 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Postfix versions prior to 3.8.16 Postfix versions 3.9 prior to 3.9.10 Postfix versions 3.10 prior to 3.10.9 **Description** A buffer over-read can occur, potentially leading to a process crash, when an enhanced status code is used that lacks text after the third number. **Recommendations** Update to version 3.8.16 or later. Update to version 3.9.10 or later. Update to version 3.10.9 or later.

**Name of the Vulnerable Software and Affected Versions** xen (affected versions not specified) **Description** Security issues were identified and addressed in the xen-4.21.1 04-1.1 package on the GA media of openSUSE Tumbleweed. **Recommendations** Update to the xen-4.21.1 04-1.1 package.