What is GHSA-mqqv-chpx-vq25?

GHSA-mqqv-chpx-vq25 is a security advisory published by GitHub Security Advisories with High severity. goxmldsig vulnerable to crash on nil-pointer dereference caused by sending malformed XML signatures

Which CVE IDs does GHSA-mqqv-chpx-vq25 cover?

GHSA-mqqv-chpx-vq25 covers the following CVE IDs: CVE-2020-7711. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mqqv-chpx-vq25?

GHSA-mqqv-chpx-vq25 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-mqqv-chpx-vq25?

GHSA-mqqv-chpx-vq25 affects 2 products, including: go/github.com/russellhaering/goxmldsig:\u003c 1.1.1; go/github.com/russellhaering/gosaml2:\u003c 0.7.0.

GHSA-mqqv-chpx-vq25HighCVSS 7.5

goxmldsig vulnerable to crash on nil-pointer dereference caused by sending malformed XML signatures

Vendor

GitHub Security Advisories

Published

October 7, 2022

Last Modified

May 20, 2024

🔗 CVE IDs covered (1)

CVE-2020-7711 →

📋 Description

This affects all versions of package github.com/russellhaering/goxmldsig prior to 1.1.1. There is a crash on nil-pointer dereference caused by sending malformed XML signatures. This issue is patched in version 1.1.1.

🎯 Affected products2

go/github.com/russellhaering/goxmldsig:< 1.1.1
go/github.com/russellhaering/gosaml2:< 0.7.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2020-7711
https://github.com/russellhaering/goxmldsig/issues/48
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMRUSSELLHAERINGGOXMLDSIG-608301
https://pkg.go.dev/vuln/GO-2020-0046
https://github.com/russellhaering/gosaml2/issues/59
https://github.com/advisories/GHSA-mqqv-chpx-vq25