GitHub Advisoryadvisory · Go

GHSA-m9hp-7r99-94h5 Critical security issues in XML encoding in github.com/dexidp/dex

CRITICAL Published 2021-12-20 Modified 2021-05-21 Official page ↗

Aliases: CVE-2020-26290
Ecosystem: Go
Packages: github.com/dexidp/dex, github.com/russellhaering/goxmldsig
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses: CWE-347
Reviewed: 2021-05-21

Affected packages

• Go github.com/dexidp/dex: < 2.27.0 → fixed in 2.27.0 • Go github.com/russellhaering/goxmldsig: < 1.1.0 → fixed in 1.1.0

Description

Impact The following vulnerabilities have been disclosed, which impact users leveraging the SAML connector: Signature Validation Bypass (CVE-2020-15216): https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7 `encoding/xml` instabilities: • Element namespace prefix instability (CVE-2020-29511) • Attribute namespace prefix instability (CVE-2020-29509) • Directive comment instability (CVE-2020-29510) Patches Immediately update to Dex v2.27.0. Workarounds There are no known workarounds.

Related

Alias · CVE (1)

CVE-2020-26290 Dex is a federated OpenID Connect provider written in Go. vulnerability

Weakness · CWE (1)

CWE-347 Improper Verification of Cryptographic Signature weakness

References