—
GO-2020-0046
Panic due to malformed XML digital signature in github.com/russellhaering/goxmldsig
Quick fix
GO-2020-0046 — github.com/russellhaering/goxmldsig: upgrade to the fixed version with the command below.
go get github.com/russellhaering/goxmldsig@v1.1.1Details
Due to a nil pointer dereference, a malformed XML Digital Signature can cause a panic during validation. If user supplied signatures are being validated, this may be used as a denial of service vector.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/russellhaering/goxmldsig
Introduced in:
0Fixed in: 1.1.1Fix
go get github.com/russellhaering/goxmldsig@v1.1.1Go/github.com/russellhaering/gosaml2
Introduced in:
0Fixed in: 0.7.0Fix
go get github.com/russellhaering/gosaml2@v0.7.0