CRITICAL9.8

GHSA-2x32-jm95-2cpx

Authentication Bypass in dex

Quick fix

GHSA-2x32-jm95-2cpx — github.com/dexidp/dex: upgrade to the fixed version with the command below.

go get github.com/dexidp/dex@v2.27.0

Details

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/dexidp/dex

Introduced in: 0Fixed in: 2.27.0

Fixgo get github.com/dexidp/dex@v2.27.0

References

https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2020-27847[ADVISORY]
https://bugzilla.redhat.com/show_bug.cgi?id=1907732[WEB]
https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities[WEB]