~ / search / GHSA-prjq-f4q3-fvfr

GHSA-prjq-f4q3-fvfr

github.com/russellhaering/gosaml2 is vulnerable to NULL Pointer Dereference

Source: GitHub Advisory Database (reviewed) High CVE-2020-7731

Packages

EcosystemPackageAffectedFixed in
Go github.com/russellhaering/gosaml2 < 0.7.0 0.7.0
Go github.com/russellhaering/goxmldsig < 1.1.1 1.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact In versions prior to v0.7.0 it was possible for an attacker to supply an invalid assertion which would trigger a panic due to a nil-pointer dereference. ### Patches The issue was patched in v0.7.0, released on March 2, 2022. ### Workarounds Callers to `gosaml2` can use `recover()` to handle panics to mitigate a potential DoS. ### References See issue [#59](https://github.com/russellhaering/gosaml2/issues/59) for details.

References

External links from the advisory. They lead to third-party sites.