GHSA-m9hp-7r99-94h5 CVE-2020-26290 CVE-2020-27847 GHSA-2x32-jm95-2cpx
Critical security issues in XML encoding in github.com/dexidp/dex
- Severity
- 9.3 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 1.72%
- Chance of exploitation in the next 30 days. Higher than 77.45% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-347 Improper Verification of Cryptographic Signature
- Fix
- Available
- 2 packages have a fixed version
Description
Impact
The following vulnerabilities have been disclosed, which impact users leveraging the SAML connector:
Signature Validation Bypass (CVE-2020-15216): https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7
encoding/xml instabilities:
- Element namespace prefix instability (CVE-2020-29511)
- Attribute namespace prefix instability (CVE-2020-29509)
- Directive comment instability (CVE-2020-29510)
Patches
Immediately update to Dex v2.27.0.
Workarounds
There are no known workarounds.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/dexidp/dex | < 2.27.0 |
2.27.0 |
| github.com/russellhaering/goxmldsig | < 1.1.0 |
1.1.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/dexidp/dex Go → 2.27.0
- go
go get github.com/dexidp/dex@v2.27.0 && go mod tidy
github.com/russellhaering/goxmldsig Go → 1.1.0
- go
go get github.com/russellhaering/goxmldsig@v1.1.0 && go mod tidy
Severity breakdown
CVSS 3.1 9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
References
Advisories
Other links
- github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5
- bugzilla.redhat.com/show_bug.cgi
- mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities
- github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7
- github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8
- github.com/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb961…
- github.com/dexidp/dex/releases/tag/v2.27.0
- github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-a…
- github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-d…
- github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-e…
- pkg.go.dev/vuln/GO-2020-0050
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-q547-gmf8-8jr7 github.com/russellhaering/goxmldsig vulnerable to Signature Validation Bypass | Medium | Linked by the source |
| GHSA-479m-364c-43vc validateSignature Loop Variable Capture Signature Bypass in goxmldsig | High | Also affects github.com/russellhaering/goxmldsig |
| GHSA-rrfw-hg9m-j47h Signature Validation Bypass | Critical | Also affects github.com/russellhaering/goxmldsig |
| GHSA-mqqv-chpx-vq25 Duplicate Advisory: gosaml2 is vulnerable to NULL Pointer Dereference from malformed XML signatures | High | Also affects github.com/russellhaering/goxmldsig |
| EEF-CVE-2026-65632 ECDSA signature length is not validated in jose, allowing signature malleability | Not rated yet | Same weakness, CWE-347 |
| GHSA-pxh4-856f-4h89 PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery | High | Same weakness, CWE-347 |
| GHSA-j7h2-66j4-ghjf A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request | Low | Same weakness, CWE-347 |
| GHSA-w2cx-738m-mc7w PyJWT accepts public JWK containers as HMAC secrets | High | Same weakness, CWE-347 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor