GitHub Advisoryadvisory · Go

GHSA-rrfw-hg9m-j47h Signature Validation Bypass

CRITICAL Published 2021-05-24 Modified 2021-10-08 Official page ↗
Ecosystem
Go
Packages
github.com/russellhaering/goxmldsig
Severity
Critical
Weaknesses
CWE-347
Reviewed
2021-05-21

Affected packages

• Go github.com/russellhaering/goxmldsig: < 0.4.2 → fixed in 0.4.2

Description

Impact An authentication bypass exists in the goxmldsig this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP. Patches Version 0.4.2 bumps the dependency which should fix the issue. For more information Please see the advisory in goxmldsig Credits The original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.

Related

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References