diff --git a/gems/omniauth-saml/GHSA-cgp2-2cmh-pf7x.yml b/gems/omniauth-saml/GHSA-cgp2-2cmh-pf7x.yml deleted file mode 100644 index 0d7b78ce20..0000000000 --- a/gems/omniauth-saml/GHSA-cgp2-2cmh-pf7x.yml +++ /dev/null @@ -1,28 +0,0 @@ ---- -gem: omniauth-saml -ghsa: cgp2-2cmh-pf7x -url: https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cgp2-2cmh-pf7x -title: Bad documentation for idp_cert_fingerprint_validator -date: 2025-05-27 -description: | - Documentation: - https://github.com/omniauth/omniauth-saml#:~:text=%2C%0A%20%20%3Aidp_cert_fingerprint%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3D%3E%20%22E7%3A91%3AB2%3AE1%3A...%22%2C-,%3Aidp_cert_fingerprint_validator%20%20%20%20%20%3D%3E%20lambda%20%7B%20%7Cfingerprint%7C%20fingerprint%20%7D%2C,-%3Aname_identifier_format%20%20%20%20%20%20%20%20%20%20%20%20%20%3D%3E%20%22urn%3Aoasis%3Anames%3Atc%3ASAML%3A1.1%3Anameid%2Dformat - - Has the line: - :idp_cert_fingerprint_validator => lambda { |fingerprint| fingerprint }, - - This proc returns true for any fingerprint, allowing any certificate - to be trusted. - - Update documentation to encourage secure defaults. -patched_versions: - - ">= 2.2.4" -related: - url: - - https://rubygems.org/gems/omniauth-saml/versions/2.2.4 - - https://github.com/omniauth/omniauth-saml/releases/tag/v2.2.4 - - https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cgp2-2cmh-pf7x -notes: | - - No CVE. - - GHSA has "low" severity. - - date from GHSA diff --git a/lib/rad-ignores.sh b/lib/rad-ignores.sh index bad621e0bb..f52d3f0dc0 100755 --- a/lib/rad-ignores.sh +++ b/lib/rad-ignores.sh @@ -88,6 +88,10 @@ rm -f gems/webrick/CVE-2026-38969.yml # https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q # are not a Ruby gems, no Ruby code. +# https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cgp2-2cmh-pf7x +# Dev said, so removed advisory: "The listed vulnerability is an error in +# their documented usage. Updating the gem does not make an app more secure." +rm -f gems/omniauth-saml/GHSA-cgp2-2cmh-pf7x.yml # https://github.com/joniles/mpxj/security/advisories/GHSA-jf2p-4gqj-849g # does not involve Ruby code.