{"id":"GHSA-rrfw-hg9m-j47h","aliases":[],"status":"published","title":"Signature Validation Bypass","description":"### Impact\n\nAn authentication bypass exists in the [goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7) this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.\n\n### Patches\n\nVersion 0.4.2 bumps the dependency which should fix the issue.\n\n### For more information\n\nPlease see [the advisory in goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7)\n\n## Credits\n\nThe original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2021-05-24T16:59:42Z","modified":"2023-01-09T05:04:58Z","fixes":[{"ecosystem":"Go","package":"github.com/russellhaering/goxmldsig","fixed_in":["0.4.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/russellhaering/goxmldsig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.1"},{"fixed":"0.4.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/russellhaering/goxmldsig","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.2"}]}]}],"references":[{"url":"https://github.com/crewjam/saml/security/advisories/GHSA-rrfw-hg9m-j47h","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rrfw-hg9m-j47h"},{"url":"https://github.com/russellhaering/goxmldsig","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-rrfw-hg9m-j47h","title":"Signature Validation Bypass","description":"### Impact\n\nAn authentication bypass exists in the [goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7) this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.\n\n### Patches\n\nVersion 0.4.2 bumps the dependency which should fix the issue.\n\n### For more information\n\nPlease see [the advisory in goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7)\n\n## Credits\n\nThe original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.","status":"published","published":"2021-05-24T16:59:42Z","modified":"2023-01-09T05:04:58Z","cwes":["CWE-347"],"updated_at":"2026-11-02T14:36:10.502376Z"}],"osv":[{"id":"GHSA-rrfw-hg9m-j47h","title":"Signature Validation Bypass","description":"### Impact\n\nAn authentication bypass exists in the [goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7) this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.\n\n### Patches\n\nVersion 0.4.2 bumps the dependency which should fix the issue.\n\n### For more information\n\nPlease see [the advisory in goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7)\n\n## Credits\n\nThe original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.","status":"published","published":"2021-05-24T16:59:42Z","modified":"2021-10-08T21:25:26Z","cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:56.281047Z"}]}}