modules:
  - module: github.com/russellhaering/gosaml2
    versions:
      - fixed: 0.6.0
    vulnerable_at: 0.5.0
    packages:
      - package: github.com/russellhaering/gosaml2
        symbols:
          - parseResponse
        derived_symbols:
          - SAMLServiceProvider.RetrieveAssertionInfo
          - SAMLServiceProvider.ValidateEncodedLogoutRequestPOST
          - SAMLServiceProvider.ValidateEncodedLogoutResponsePOST
          - SAMLServiceProvider.ValidateEncodedResponse
description: |
    Due to the behavior of encoding/xml, a crafted XML document may cause
    XML Digital Signature validation to be entirely bypassed, causing an
    unsigned document to appear signed.
published: 2021-04-14T20:04:52Z
cves:
  - CVE-2020-29509
ghsas:
  - GHSA-xhqq-x44f-9fgg
credit: Juho Nurminen
references:
  - fix: https://github.com/russellhaering/gosaml2/commit/42606dafba60c58c458f14f75c4c230459672ab9