GHSA-rrfw-hg9m-j47h

    Dashboard / Vulnerabilities / GHSA-rrfw-hg9m-j47h

    GHSA-rrfw-hg9m-j47h

    Published: 24 May 2021Last Modified: 8 Oct 2021

    Summary: Signature Validation Bypass

    Details: ### Impact An authentication bypass exists in the [goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7) this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP. ### Patches Version 0.4.2 bumps the dependency which should fix the issue. ### For more information Please see [the advisory in goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7) ## Credits The original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.

    References: https://github.com/crewjam/saml/security/advisories/GHSA-rrfw-hg9m-j47h, https://github.com/russellhaering/goxmldsig

    Affected packages

    Package

    Name: github.com/russellhaering/goxmldsig

    Purl: pkg:golang/github.com/russellhaering/goxmldsig

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.4.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-rrfw-hg9m-j47h | CVE-DB