PT-2020-16808 · Google+6 · Go+6

Jason Shepherd · Published 2020-12-17 · Updated 2024-03-06 · CVE-2020-27846

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions crewjam/saml (affected versions not specified)

Description A signature verification issue exists, allowing an attacker to bypass SAML Authentication, posing a threat to confidentiality, integrity, and system availability. This issue can be exploited by forging part of a signed XML document. The go encoding/xml package is also affected, where a crafted XML document may cause XML Digital Signature validation to be entirely bypassed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-115

CWE-287

Related Identifiers

ALT-PU-2021-1180

ALT-PU-2022-1177

ALT-PU-2022-1249

BIT-GRAFANA-2020-27846

CESA-2021_1859

CVE-2020-27846

GHSA-4HQ8-GMXX-H6W9

GO-2021-0058

OESA-2021-1445

RHSA-2021:1859

RHSA-2021_1859

RLSA-2021:1859

Affected Products

Alt Linux

Centos

Grafana

Red Hat

Rocky Linux

Crewjam/Saml

Go

References · 35

• 🔥 https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities · Exploit
• https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise · Vendor Advisory
• https://osv.dev/vulnerability/GO-2021-0058 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-27846 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-28148 · Security Note
• https://linux.oracle.com/errata/ELSA-2021-1859.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1907670 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-27846 · Security Note
• https://osv.dev/vulnerability/RLSA-2021:1859 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1445 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27358 · Security Note
• https://osv.dev/vulnerability/GHSA-4hq8-gmxx-h6w9 · Vendor Advisory