GitHub Advisoryadvisory · Go

GHSA-599h-8wpj-75xj Authentication Bypass in tyk-identity-broker

CRITICAL Published 2021-06-23 Modified 2021-05-20 Official page ↗
Aliases
CVE-2021-23365
Ecosystem
Go
Packages
github.com/tyktechnologies/tyk-identity-broker
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-287
Reviewed
2021-05-20

Affected packages

• Go github.com/tyktechnologies/tyk-identity-broker: < 1.1.1 → fixed in 1.1.1

Description

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).

Related

Alias · CVE (1)

  • CVE-2021-23365 The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References