What is GHSA-rrfw-hg9m-j47h?

GHSA-rrfw-hg9m-j47h is a security advisory published by GitHub Security Advisories with Critical severity. Signature Validation Bypass

Why does GHSA-rrfw-hg9m-j47h have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-rrfw-hg9m-j47h?

GHSA-rrfw-hg9m-j47h affects 1 product, including: go/github.com/russellhaering/goxmldsig:\u003c= 0.4.1.

GHSA-rrfw-hg9m-j47hCriticalDisclosed before NVD

Signature Validation Bypass

Vendor

GitHub Security Advisories

Published

May 24, 2021

Last Modified

January 9, 2023

📋 Description

Impact

An authentication bypass exists in the goxmldsig this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.

Patches

Version 0.4.2 bumps the dependency which should fix the issue.

For more information

Please see the advisory in goxmldsig

Credits

The original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.

🎯 Affected products1

go/github.com/russellhaering/goxmldsig:<= 0.4.1

🔗 References (2)

https://github.com/crewjam/saml/security/advisories/GHSA-rrfw-hg9m-j47h
https://github.com/advisories/GHSA-rrfw-hg9m-j47h