Signature bypass via multiple Assertion elements

Critical

crewjam published GHSA-j2jp-wvqg-wc2g

Nov 28, 2022

Package

crewjam/saml (Go)

Affected versions

< 0.4.8

Patched versions

0.4.9

Description

Impact

The crewjam/saml go library is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements.

Patches

This issue has been corrected in version 0.4.9

Credit

This issue was reported by Felix Wilhelm from Google Project Zero.

Severity

Critical

9.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N