—

GO-2020-0047

Weak hash (SHA-1) in github.com/RobotsAndPencils/go-saml

Details

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/RobotsAndPencils/go-saml

Introduced in: 0

No fixed version published yet for github.com/RobotsAndPencils/go-saml (go modules). Pin to a known-safe version or switch to an alternative.

References

https://github.com/RobotsAndPencils/go-saml/pull/38[WEB]