CVE request: drupalauth module for simpleSAMLphp trivial impersonation

["Thijs Kinkhorst" <thijs () debian org>]

Hi,

Alan Barrett reported an issue in the drupalauth module for simpleSAMLphp,
which takes the username out of a cookie which is obviously under control
of the user.

Report and patch:
http://code.google.com/p/drupalauth/issues/detail?id=9

(Note that this is an independently developed module not part of the
simpleSAMLphp core distribution. Note also that this module is used for
Drupal as an authentication source, and is not related to using Drupal
with simpleSAMLphp as an SP).


Cheers,
Thijs