PT-2020-16408 · Mattermost+1 · Xml-Roundtrip-Validator+1

Published 2020-12-28 · Updated 2024-06-15 · CVE-2020-26290

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dex versions prior to 2.27.0

Description The issue impacts users leveraging the SAML connector and enables potential signature bypass due to issues with XML encoding in the underlying Go library. With a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. The problem arises due to the behavior of encoding/xml, where a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed.

Recommendations For versions prior to 2.27.0, update to version 2.27.0 or later, which addresses the issue by using the xml-roundtrip-validator from Mattermost. Additionally, users of goxmldsig should upgrade to v1.1.0. As a temporary workaround, consider restricting the use of the SAML connector until the update is applied.

Fix

Authentication Bypass by Spoofing

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-290

CWE-347

CWE-228

Related Identifiers

CVE-2020-26290

GHSA-2X32-JM95-2CPX

GHSA-M9HP-7R99-94H5

GHSA-Q547-GMF8-8JR7

GO-2020-0050

OPENSUSE-SU-2024:10714-1

Affected Products

Encoding/Xml

Xml-Roundtrip-Validator

References · 25

• https://github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8 · Patch
• https://osv.dev/vulnerability/GO-2020-0050 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10714-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/GUH33FPUXED3FHYL25BJOQPRKFGPOMS2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ZECBFD4M4PHBMBOCMSQ537NOU37QOVWP · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q547-gmf8-8jr7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26290 · Security Note
• https://osv.dev/vulnerability/GHSA-m9hp-7r99-94h5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15216 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26290 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2x32-jm95-2cpx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27847 · Security Note
• https://github.com/dexidp/dex/releases/tag/v2.27.0 · Note
• https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5 · Note
• https://github.com/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb9615e64 · Note