Описание
Critical security issues in XML encoding in github.com/dexidp/dex
Impact
The following vulnerabilities have been disclosed, which impact users leveraging the SAML connector:
Signature Validation Bypass (CVE-2020-15216): https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7
encoding/xml instabilities:
- Element namespace prefix instability (CVE-2020-29511)
- Attribute namespace prefix instability (CVE-2020-29509)
- Directive comment instability (CVE-2020-29510)
Patches
Immediately update to Dex v2.27.0.
Workarounds
There are no known workarounds.
Ссылки
- https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5
- https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7
- https://nvd.nist.gov/vuln/detail/CVE-2020-26290
- https://github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8
- https://github.com/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb9615e64
- https://github.com/dexidp/dex/releases/tag/v2.27.0
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
- https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities
- https://pkg.go.dev/vuln/GO-2020-0050
Пакеты
github.com/dexidp/dex
< 2.27.0
2.27.0
github.com/russellhaering/goxmldsig
< 1.1.0
1.1.0
Связанные уязвимости
Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).
Dex is a federated OpenID Connect provider written in Go. In Dex befor ...