—

GO-2021-0058

Signature validation bypass due to XML processing error in github.com/crewjam/saml

Quick fix

GO-2021-0058 — github.com/crewjam/saml: upgrade to the fixed version with the command below.

go get github.com/crewjam/saml@v0.4.3

Details

Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/crewjam/saml

Introduced in: 0Fixed in: 0.4.3

Fixgo get github.com/crewjam/saml@v0.4.3

References

https://github.com/crewjam/saml/commit/da4f1a0612c0a8dd0452cf8b3c7a6518f6b4d053[FIX]