CVE-2020-26290

🗓️ 28 Dec 2020 19:15:17Reported by GitHub_MType

Dex OpenID Connect provider in Go, version 2.27.0 critical SAML connector vulnerabilitie

Reporter	Title	Published	Views	Family All 17
AlpineLinux	CVE-2020-26290	28 Dec 202019:15	–	alpinelinux
Circl	CVE-2020-26290	28 Dec 202022:28	–	circl
CNNVD	Dexidp Dex Data Forgery Issue Vulnerability	28 Dec 202000:00	–	cnnvd
Cvelist	CVE-2020-26290 Critical security issues in XML encoding in Dex	28 Dec 202019:15	–	cvelist
EUVD	EUVD-2021-2551	7 Oct 202500:30	–	euvd
Github Security Blog	Critical security issues in XML encoding in github.com/dexidp/dex	20 Dec 202117:53	–	github
NVD	CVE-2020-26290	28 Dec 202020:15	–	nvd
OSV	CGA-F6M3-CPMW-VJ78	29 Jan 202600:46	–	osv
OSV	CGA-W29Q-H459-6537	6 Jun 202412:29	–	osv
OSV	GHSA-M9HP-7R99-94H5 Critical security issues in XML encoding in github.com/dexidp/dex	20 Dec 202117:53	–	osv

NVD

Vulners

Node

linuxfoundation dexRange<2.27.0

[
  {
    "product": "dex",
    "vendor": "dexidp",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.27.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
github	www.github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md
github	www.github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5
mattermost	www.mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
github	www.github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8
github	www.github.com/dexidp/dex/releases/tag/v2.27.0
github	www.github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md
github	www.github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7

21 Nov 2024 05:19Current

9.8High risk

Vulners AI Score9.8

CVSS 26.8

CVSS 3.19.3 - 9.6

EPSS0.005

CWE-347

dex openid connect go saml vulnerabilities xml encoding signature bypass nvd cve-2020-26290