GHSA-prjq-f4q3-fvfrHighCVSS 7.5

github.com/russellhaering/gosaml2 is vulnerable to NULL Pointer Dereference

Published
November 15, 2022
Last Modified
May 20, 2024

🔗 CVE IDs covered (1)

CVE-2020-7731 →

📋 Description

Impact

In versions prior to v0.7.0 it was possible for an attacker to supply an invalid assertion which would trigger a panic due to a nil-pointer dereference.

Patches

The issue was patched in v0.7.0, released on March 2, 2022.

Workarounds

Callers to gosaml2 can use recover() to handle panics to mitigate a potential DoS.

References

See issue #59 for details.

🎯 Affected products2

  • go/github.com/russellhaering/gosaml2:< 0.7.0
  • go/github.com/russellhaering/goxmldsig:< 1.1.1

🔗 References (8)