~ / search / GHSA-mqqv-chpx-vq25

GHSA-mqqv-chpx-vq25

goxmldsig vulnerable to crash on nil-pointer dereference caused by sending malformed XML signatures

Source: GitHub Advisory Database (reviewed) High CVE-2020-7711

Packages

EcosystemPackageAffectedFixed in
Go github.com/russellhaering/goxmldsig < 1.1.1 1.1.1
Go github.com/russellhaering/gosaml2 < 0.7.0 0.7.0

Details

As written in the advisory (Markdown source, shown as plain text).

This affects all versions of package github.com/russellhaering/goxmldsig prior to 1.1.1. There is a crash on nil-pointer dereference caused by sending malformed XML signatures. This issue is patched in version 1.1.1.

References

External links from the advisory. They lead to third-party sites.