logo

Database

Authentication mechanism absence or evasion In github.com/crewjam/saml

Description

crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication

Impact

The crewjam/saml go library is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements.

Patches

This issue has been corrected in version 0.4.9.

Credit

This issue was reported by Felix Wilhelm from Google Project Zero.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2022-419122. NVD-2022-419123. OSV-2022-419124. GHSA-j2jp-wvqg-wc2g5. GHSA-7rg2-cxvp-9p7p6. GCVE-2022-41912

References

1. https://github.com/crewjam/saml/security/advisories/GHSA-j2jp-wvqg-wc2g2. https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p3. https://github.com/crewjam/saml/commit/aee3fb1edeeaf1088fcb458727e0fd863d277f8b4. https://github.com/crewjam/saml/releases/tag/v0.4.95. https://pkg.go.dev/vuln/GO-2022-11296. http://packetstormsecurity.com/files/170356/crewjam-saml-Signature-Bypass.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.

FLAT-G44EU – Vulnerability | Fluid Attacks Database