{"id":"CVE-2020-27846","published":"2020-12-21T15:16:14Z","modified":"2024-08-04T16:25:43Z","title":"A signature verification vulnerability exists in crewjam/saml","vendor":null,"product":null,"tier":"tail","description":{"text":"A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04931,"percentile":0.92126,"provenance":"source"},"cwes":[{"id":"CWE-115","name":"Misinterpretation of Input"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907670","tags":["x_refsource_MISC"]},{"url":"https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/","tags":["x_refsource_MISC"]},{"url":"https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9","tags":["x_refsource_MISC"]},{"url":"https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://security.netapp.com/advisory/ntap-20210205-0002/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":18.43}]},"affectedVersions":[{"vendor":"n/a","product":"crewjam/saml","versions":["grafana-7.3.6, grafana-7.2.3, grafana-6.7.5, github.com/crewjam/saml-0.4.3"]}],"affected":[{"ecosystem":"Go","package":"github.com/crewjam/saml","vulnerableRanges":["<0.4.3"],"patched":["0.4.3"],"from":["GHSA-4hq8-gmxx-h6w9","GO-2021-0058"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1260","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-crewjam-saml-cve-2020-27846","children":[{"from":"CVE-2020-27846","to":"CVE-2022-41912","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/crewjam/saml","fromFixed":"0.4.3","toFixed":"0.4.9","daysApart":707},{"kind":"same-code","provenance":"machine","files":["service_provider.go"],"commits":["https://github.com/crewjam/saml/commit/da4f1a0612c0a8dd0452cf8b3c7a6518f6b4d053","https://github.com/crewjam/saml/commit/aee3fb1edeeaf1088fcb458727e0fd863d277f8b"],"basis":"shared function","functions":["ParseXMLResponse"]}]},{"from":"CVE-2020-27846","to":"CVE-2023-28119","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["identity_provider.go","service_provider.go"],"commits":["https://github.com/crewjam/saml/commit/da4f1a0612c0a8dd0452cf8b3c7a6518f6b4d053","https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021"],"basis":"shared function","functions":["NewIdpAuthnRequest","ValidateLogoutResponseRedirect"]}]}],"packageHistory":[{"cve":"CVE-2020-27846","published":"2020-12-21","fixed":"0.4.3","kev":false},{"cve":"CVE-2022-41912","published":"2022-11-28","fixed":"0.4.9","kev":false},{"cve":"CVE-2023-28119","published":"2023-03-22","fixed":"0.4.13","kev":false},{"cve":"CVE-2023-45683","published":"2023-10-16","fixed":"0.4.14","kev":false}],"package":"Go:github.com/crewjam/saml"}}