GHSA-m9hp-7r99-94h5
Suggest an improvement- Source
- https://github.com/advisories/GHSA-m9hp-7r99-94h5
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-m9hp-7r99-94h5/GHSA-m9hp-7r99-94h5.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-m9hp-7r99-94h5
- Aliases
- Related
- Published
- 2021-12-20T17:53:53Z
- Modified
- 2025-01-08T07:27:16.983484Z
- Severity
-
- 9.3 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
- Summary
- Critical security issues in XML encoding in github.com/dexidp/dex
- Details
-
Impact
The following vulnerabilities have been disclosed, which impact users leveraging the SAML connector:
Signature Validation Bypass (CVE-2020-15216): https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7
encoding/xmlinstabilities: - Element namespace prefix instability (CVE-2020-29511) - Attribute namespace prefix instability (CVE-2020-29509) - Directive comment instability (CVE-2020-29510)Patches
Immediately update to Dex v2.27.0.
Workarounds
There are no known workarounds.
- Database specific
{ "severity": "CRITICAL", "nvd_published_at": null, "github_reviewed": true, "cwe_ids": [ "CWE-347" ], "github_reviewed_at": "2021-05-21T20:49:36Z" }- References
-
- https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5
- https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7
- https://nvd.nist.gov/vuln/detail/CVE-2020-26290
- https://github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8
- https://github.com/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb9615e64
- https://github.com/dexidp/dex/releases/tag/v2.27.0
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities
- https://pkg.go.dev/vuln/GO-2020-0050
Affected packages
Go / github.com/dexidp/dex
Package
- Name
- github.com/dexidp/dex
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/dexidp/dex
Go / github.com/russellhaering/goxmldsig
Package
- Name
- github.com/russellhaering/goxmldsig
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/russellhaering/goxmldsig