GHSA-xhqq-x44f-9fgg
Authentication Bypass in github.com/russellhaering/gosaml2
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2020-29509
- Alias
- BIT-golang-2020-29509, GO-2021-0060
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
### Impact Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed. Depending on the implementation of the Service Provider this enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in the Identity Provider, or full authentication bypass. ### Patches Service Providers utilizing gosaml2 should upgrade to v0.6.0 or greater.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · github.com/russellhaering/gosaml2 | introduced 0, fixed 0.6.0 |
Références
- https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-29509 ADVISORY
- https://github.com/russellhaering/gosaml2/commit/42606dafba60c58c458f14f75c4c230459672ab9 WEB
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md WEB
- https://pkg.go.dev/vuln/GO-2021-0060 WEB
- https://security.netapp.com/advisory/ntap-20210129-0006 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |