GitHub Advisoryadvisory · Go

GHSA-4hq8-gmxx-h6w9 XML Processing error in github.com/crewjam/saml

CRITICAL Published 2021-06-23 Modified 2025-09-19 Official page ↗
Aliases
CVE-2020-27846
Ecosystem
Go
Packages
github.com/crewjam/saml
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-115, CWE-287
Reviewed
2021-05-21

Affected packages

• Go github.com/crewjam/saml: < 0.4.3 → fixed in 0.4.3

Description

Impact There are three vulnerabilities in the go `encoding/xml` package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see xml-roundtrip-validator Patches In version 0.4.3, all XML input is validated prior to being parsed.

Related

Alias · CVE (1)

  • CVE-2020-27846 A signature verification vulnerability exists in crewjam/saml. vulnerability

Weakness · CWE (2)

  • CWE-115 Misinterpretation of Input weakness
  • CWE-287 Improper Authentication weakness

References