GitHub Advisoryadvisory · Go

GHSA-2x32-jm95-2cpx Authentication Bypass in dex

CRITICAL Published 2021-12-20 Modified 2021-06-01 Official page ↗
Aliases
CVE-2020-27847
Ecosystem
Go
Packages
github.com/dexidp/dex
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-228, CWE-290
Reviewed
2021-06-01

Affected packages

• Go github.com/dexidp/dex: < 2.27.0 → fixed in 2.27.0

Description

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.

Related

Alias · CVE (1)

  • CVE-2020-27847 A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. vulnerability

Weakness · CWE (2)

  • CWE-228 Improper Handling of Syntactically Invalid Structure weakness
  • CWE-290 Authentication Bypass by Spoofing weakness

References