Contentful: SAML vulnerability update (CVE-2017-11428)
Timeline of updates
- resolved
A security vulnerability was found in the way Single Sign-On works when using SAML (Security Assertion Markup Language) [1] and was responsibly disclosed on Tuesday February 27th 2018. This affected a Ruby gem used by our application where it was assigned the CVE entry CVE-2017-11428. This dependency has been patched and made available by the maintainer on the same day [2]. Our Engineers quickly identified the threat and applied the fix to our platform. Therefore, our customers are not affected by this vulnerability as of 08:00 UTC February 28th 2018. Feel free to reach out to our Security Team and Support Team with any questions that might arise through support@contentful.com. [1] https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations (opens in new tab) [2] https://github.com/onelogin/ruby-saml (opens in new tab)
From Contentful’s published incident history: for incidents before Rewindex began polling this status page, only the final update text is available.
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
This incident predates live tracking (October 17, 2026). It came from the vendor’s own published history, which is not covered by checkpoints.
Impact, status and times are the vendor’s own, as last archived. View on www.contentfulstatus.com (opens in new tab).
Cite this
Status incident (vendor impact label: none) posted by Contentful, started 2018-02-28 10:36 UTC, resolved after 0 min, 1 update(s).
- Title
- SAML vulnerability update (CVE-2017-11428)
- Vendor
- Contentful
- Date
- URL
- https://rewindex.com/company/contentful/incidents/wfggcsm90tx0
Contentful profileRecent Contentful incidentsAll outages on February 28, 2018Contentful in February 2018MarkdownJSON