Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJyZnctaGc5bS1qNDdo

Signature Validation Bypass

Impact

An authentication bypass exists in the goxmldsig this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.

Patches

Version 0.4.2 bumps the dependency which should fix the issue.

For more information

Please see the advisory in goxmldsig

Credits

The original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.

Permalink: https://github.com/advisories/GHSA-rrfw-hg9m-j47h
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJyZnctaGc5bS1qNDdo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 3 years ago
Updated: over 1 year ago

Identifiers: GHSA-rrfw-hg9m-j47h
References:

• https://github.com/crewjam/saml/security/advisories/GHSA-rrfw-hg9m-j47h
• https://github.com/advisories/GHSA-rrfw-hg9m-j47h

Repository: https://github.com/crewjam/saml
Blast Radius: 0.0

Affected Packages