Fedora 33 : grafana (2020-64e54abd9f)

update to upstream 7.3.6 Note regarding CVE-2020-27846: SAML is not supported in the open source version of Grafana, however the dependency on crewjam/saml is also present in the open source version. This update removes this dependency altogether. Note that Tenable Network Security has extracted...

Fedora 32 : grafana (2020-968067abfa)

update to upstream 7.3.6 Note regarding CVE-2020-27846: SAML is not supported in the open source version of Grafana, however the dependency on crewjam/saml is also present in the open source version. This update removes this dependency altogether. Note that Tenable Network Security has extracted...

CVE-2020-29594

Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login...

CVE-2020-29594

Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login...

Design/Logic Flaw

Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login...

CVE-2020-29594

CVE-2020-29594 affects Rocket.Chat (varying branches: before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, 3.9.x before 3.9.1) and is caused by mishandling of SAML login. The connected HackerOne report documents an unauthenticated bypass via the addSamlProvide...

Vulnerability fixed in Grafana Enterprise

Several vulnerabilities have been fixed in Grafana. A malicious party could potentially exploit the vulnerabilities to bypassing authentication when Security Assertion Markup Language SAML is used as the authentication method. In addition the vulnerabilities could potentially be exploited for oth...

CVE-2020-26290

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...

CVE-2020-26290

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...

Design/Logic Flaw

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...

CVE-2020-26290

Dex (Dexidp) is affected by CVE-2020-26290: before v2.27.0, vulnerabilities in XML encoding within the Go library could enable a signature bypass in the SAML connector. The issue has been addressed in Dex v2.27.0 by adopting the xml-roundtrip-validator from Mattermost. Affected and related adviso...

CVE-2020-26290 Critical security issues in XML encoding in Dex

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...

Vulnerability fixed in Zimbra

Synacor has fixed a vulnerability in Zimbra in the way in which XML entities are processed in zm-saml-consumer-store. This vulnerability makes it possible for a malicious person to perform a Denial-of-Service attack. Attacks carried out via this vulnerability are also known as "billion laughs"...

Advice for incident responders on recovery from systemic identity compromises

As Microsoft alongside our industry partners and the security community continues to investigate the extent of the Solorigate attack, our goal is to provide the latest threat intelligence including IOCs and guidance across our products and solutions to help the community fight back against, harde...

Advice for incident responders on recovery from systemic identity compromises

As Microsoft alongside our industry partners and the security community continues to investigate the extent of the Solorigate attack, our goal is to provide the latest threat intelligence including IOCs and guidance across our products and solutions to help the community fight back against, harde...

CVE-2020-35604

An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used...

Xxe

An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used...

CVE-2020-35604

An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used...

CVE-2020-35604

Kronos WebTA 5.0.4 with SAML enabled is affected by an XXE vulnerability. Multiple sources confirm an external-entity injection flaw in the XML processing when SAML is used, enabling a successful XXE attack. The issue is described as enabling access to sensitive information, with high-severity im...

CVE-2020-27846

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...