PT-2020-17180 · Go+1 · Encoding/Xml Package+2

Published 2020-12-14 · Updated 2024-03-06 · CVE-2020-29509

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions encoding/xml package in Go (all versions)

Description The issue allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications. This can cause XML Digital Signature validation to be entirely bypassed, making an unsigned document appear signed. Given a valid SAML Response, it may be possible for an attacker to mutate the XML document, enabling attacks such as users accessing accounts other than the one to which they authenticated or full authentication bypass.

Recommendations For the encoding/xml package in Go, upgrade to a version that includes the necessary fixes, such as gosaml2 version 0.6.0 or greater, if applicable to your specific use case. As a temporary workaround, consider restricting the processing of XML documents to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-115

Related Identifiers

AZL-6448

AZL-78900

BIT-GOLANG-2020-29509

CVE-2020-29509

GHSA-XHQQ-X44F-9FGG

GO-2021-0060

OESA-2021-1011

Affected Products

Debian

Encoding/Xml Package

Gosaml2

References · 22

• https://nvd.nist.gov/vuln/detail/CVE-2020-29509 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-29509 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xhqq-x44f-9fgg · Vendor Advisory
• https://osv.dev/vulnerability/AZL-78900 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6448 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-29509 · Security Note
• https://osv.dev/vulnerability/GO-2021-0060 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-29509 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-29509 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-golang-2020-29509 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1011 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-29509 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29509 · Vendor Advisory
• https://github.com/russellhaering/gosaml2/commit/42606dafba60c58c458f14f75c4c230459672ab9 · Note
• https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg · Note