gosaml2 安全漏洞

gosaml2 is a software application. It provides a SAML 2.0 implementation of a service provider's functionality based on etree and goxmldsig a Go implementation of pure XML digital signatures. A security vulnerability exists in gosaml2, which stems from the fact that a much larger amount of memory...

GHSA-6GC3-CRP7-25W5 gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb

Impact SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a deflate-compressed request which will consume significantly more memory during processing than the size of the...

gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb

Impact SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a deflate-compressed request which will consume significantly more memory during processing than the size of the...

PT-2023-20674 · Gosaml2 · Gosaml2

Name of the Vulnerable Software and Affected Versions: gosaml2 versions prior to 0.9.0 Description: A bug in the gosaml2 library enables attackers to craft a deflate-compressed request which will consume significantly more memory during processing than the size of the original request. This may...

github.com/russellhaering/gosaml2 is vulnerable to NULL Pointer Dereference

Impact In versions prior to v0.7.0 it was possible for an attacker to supply an invalid assertion which would trigger a panic due to a nil-pointer dereference. Patches The issue was patched in v0.7.0, released on March 2, 2022. Workarounds Callers to gosaml2 can use recover to handle panics to...

GHSA-PRJQ-F4Q3-FVFR github.com/russellhaering/gosaml2 is vulnerable to NULL Pointer Dereference

Impact In versions prior to v0.7.0 it was possible for an attacker to supply an invalid assertion which would trigger a panic due to a nil-pointer dereference. Patches The issue was patched in v0.7.0, released on March 2, 2022. Workarounds Callers to gosaml2 can use recover to handle panics to...

GHSA-XHQQ-X44F-9FGG Authentication Bypass in github.com/russellhaering/gosaml2

Impact Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed. Depending on the implementation of the Service Provider this enables a variety of attacks, including users...

Authentication Bypass in github.com/russellhaering/gosaml2

Impact Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed. Depending on the implementation of the Service Provider this enables a variety of attacks, including users...

GHSA-GQ5R-CC4W-G8XF Duplicate Advisory: gosaml2 is vulnerable to NULL Pointer Dereference from malformed XML signatures

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-prjq-f4q3-fvfr. This link is maintained to preserve external references. Original Description This affects all versions less than 0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on null...

Signature Validation Bypass

Impact Given a valid SAML Response, an attacker can potentially modify the document, bypassing signature validation in order to pass off the altered document as a signed one. This enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in th...

CVE-2020-7731

This affects all versions 0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures...

Null pointer dereference

This affects all versions 0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures...

CVE-2020-7731

The CVE-2020-7731 issue affects github.com/russellhaering/gosaml2 versions prior to 0.7.0, causing a nil-pointer dereference when processing malformed XML signatures. The vulnerability is fixed in v0.7.0 (released Mar 2, 2022). Remediation: upgrade to 0.7.0 or later. Workarounds mentioned in rela...

CVE-2020-7731 Denial of Service (DoS)

This affects all versions 0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures...

GO-2021-0060 Authentication bypass in github.com/russellhaering/gosaml2

Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...

PT-2020-17180 · Go +1 · Gosaml2 +2

Name of the Vulnerable Software and Affected Versions: encoding/xml package in Go all versions Description: The issue allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications. This can cause XML Digital Signature...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. There is a crash on nil-pointer dereference caused by sending malformed XML signatures. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and...

PT-2020-19733 · Russell Haering · Gosaml2 +1

Name of the Vulnerable Software and Affected Versions: github.com/russellhaering/goxmldsig versions prior to 1.1.1 github.com/russellhaering/gosaml2 versions prior to 0.7.0 Description: The issue is caused by a nil-pointer dereference when sending malformed XML signatures, leading to a crash. Thi...