GitHub修補重大層級的SAML身分驗證繞過漏洞
支付動態 · 2024-10-17
近期GitHub更新Enterprise Server（GHES），當中修補重大層級的身分驗證繞過漏洞CVE-2024-9487，並指出這項漏洞是處理另一項漏洞的過程引發
10月10日GitHub發布Enterprise Server（GHES）更新3.14.2、3.13.5、3.12.10、3.11.16版，當中修補身分驗證繞過漏洞CVE-2024-9487、資訊洩漏漏洞CVE-2024-9539，以及1個尚未登記CVE編號的漏洞。
其中，最值得留意的是被評為重大層級的CVE-2024-9487，攻擊者可藉由選用的加密斷言（assertion）功能繞過SAML單一簽入（SSO）身分驗證，而能在未經授權的情況下為使用者開通服務，或是存取GHES執行個體。此漏洞的4.0版CVSS風險評分達到9.5（滿分10分）。
對於CVE-2024-9487發生的原因，GitHub表示是他們在今年5月緩解CVE-2024-4985（CVSS風險評為10分）的過程當中衍生。
不過，攻擊者若要利用這項漏洞，必須在特定條件才能觸發：他們要能夠存取已完成簽章簽署的SAML回應，或是相關的中繼資料文件，才有機會得逞。
GitHub強調，並非所有的GHES都曝險。他們指出，預設組態的GHES並未啟動加密斷言機制，而不受影響；再者，若是未採用SAML單一簽入這類身分驗證機制，或用上述單一簽入但未搭配加密斷言的情況下，也不會受到這項漏洞資安風險的影響。
Popular articles
Across 6 Cities: HUIDU Invites You to 8 World Cup Parties Redefining High-Value Social Networking
HUIDU Focus
Gaming & Technology Expo Makes a Powerful Entrance in CDMX
Marketing
UK MPs reopen 2025 gambling inquiry as reform stalls
Regulation
Indiana online casino bill stalls in House committee
Regulation
JILI Partners with Cricket Legend AB de Villiers (ABD) to Launch Exclusive Branded Game Series 100% 11
Sports Game
1spin4win releases unique slot Don Catleone Hold and Win featuring gangster cats
Online Game
Vietnam's tightening online gaming policy creates new market opportunities
Southeast Asia
Are you ready to maximize your earnings? Try ProPush.me Constructor!
Marketing
GGC Awards 2026 Shines in Colombo: Honoring Leaders and Innovators in the iGaming Industry
HUIDU Focus
Online gambling, crypto pose ongoing money laundering risks in Philippines, analyst says
Southeast Asia
SBC Summit Canada to Make Player Safety a Key Pillar of 2026 Agenda
Marketing
Vietnam’s Controlled Gaming Shift Gains Ground, But Domestic Demand Still Lags
Southeast Asia
PropellerAds Shared a New iGaming Case Study: 97,674 Installs and 12,701 Deposits in 3 Months
Marketing
GAT CDMX 2025 Institutional Academy: Leaders and Experts Analyze the Present and Future of the Gaming Industry in Mexico and Lat
Sports Game
Kazakhstan plans to penalise online casino promotions
Regulation
