VDB
Sign up
HIGH7.5

GHSA-mqqv-chpx-vq25

goxmldsig vulnerable to crash on nil-pointer dereference caused by sending malformed XML signatures

Quick fix

GHSA-mqqv-chpx-vq25 — github.com/russellhaering/goxmldsig: upgrade to the fixed version with the command below.

go get github.com/russellhaering/goxmldsig@v1.1.1

Details

This affects all versions of package github.com/russellhaering/goxmldsig prior to 1.1.1. There is a crash on nil-pointer dereference caused by sending malformed XML signatures. This issue is patched in version 1.1.1.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/russellhaering/goxmldsig
Introduced in: 0Fixed in: 1.1.1
Fixgo get github.com/russellhaering/goxmldsig@v1.1.1
Go/github.com/russellhaering/gosaml2
Introduced in: 0Fixed in: 0.7.0
Fixgo get github.com/russellhaering/gosaml2@v0.7.0

References