GHSA-4hq8-gmxx-h6w9 BIT-grafana-2020-27846 CVE-2020-27846 GO-2021-0058
XML Processing error in github.com/crewjam/saml
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 4.93%
- Chance of exploitation in the next 30 days. Higher than 92.14% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
0.4.3- Upgrade github.com/crewjam/saml to this version or later
Description
Impact
There are three vulnerabilities in the go encoding/xml package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see xml-roundtrip-validator
Patches
In version 0.4.3, all XML input is validated prior to being parsed.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/crewjam/saml | < 0.4.3 |
0.4.3 |
| github.com/crewjam/saml | < 0.4.3 |
0.4.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/crewjam/saml Go → 0.4.3
- go
go get github.com/crewjam/saml@v0.4.3 && go mod tidy
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-115: Misinterpretation of Input
The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
References
Advisories
- github.com/advisories/GHSA-4hq8-gmxx-h6w9
- github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9
- nvd.nist.gov/vuln/detail/CVE-2020-27846
- grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-importan…
- mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities
- security.netapp.com/advisory/ntap-20210205-0002
Fixes and patches
Packages
Other links
- bugzilla.redhat.com/show_bug.cgi
- pkg.go.dev/vuln/GO-2021-0058
- grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-importan…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YUTK…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICP3Y…
- mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities
- security.netapp.com/advisory/ntap-20210205-0002
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YU…
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-267v-3v32-g6q5 Cross-site Scripting via missing Binding syntax validation | Medium | Also affects github.com/crewjam/saml |
| GHSA-5mqj-xc49-246p crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb | High | Also affects github.com/crewjam/saml |
| GHSA-j2jp-wvqg-wc2g crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication | Critical | Also affects github.com/crewjam/saml |
| GHSA-8jr5-v98p-w75m vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations | Medium | Same weakness, CWE-115 |
| GHSA-xf8x-j4p2-f749 Astro allows unauthorized third-party images in _image endpoint | Medium | Same weakness, CWE-115 |
| GHSA-qxp5-gwg8-xv66 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net | Medium | Same weakness, CWE-115 |
| GHSA-f9c6-4j9h-6c5r Misinterpretation of Input in thorsten/phpmyfaq | Medium | Same weakness, CWE-115 |
| GHSA-8cr8-4vfw-mr7h REXML round-trip instability | High | Same weakness, CWE-115 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor