Skip to content

Signature Validation Bypass

Critical severity GitHub Reviewed Published Sep 29, 2020 in crewjam/saml • Updated Jan 9, 2023

Package

gomod github.com/russellhaering/goxmldsig (Go)

Affected versions

<= 0.4.1

Patched versions

0.4.2

Description

Impact

An authentication bypass exists in the goxmldsig this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.

Patches

Version 0.4.2 bumps the dependency which should fix the issue.

For more information

Please see the advisory in goxmldsig

Credits

The original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.

References

@crewjam crewjam published to crewjam/saml Sep 29, 2020
Reviewed May 21, 2021
Published to the GitHub Advisory Database May 24, 2021
Last updated Jan 9, 2023

Severity

Critical

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-rrfw-hg9m-j47h

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.