modules:
  - module: github.com/RobotsAndPencils/go-saml
    vulnerable_at: 0.0.0-20170520135329-fb13cb52a46b
    packages:
      - package: github.com/RobotsAndPencils/go-saml
        symbols:
          - AuthnRequest.Validate
          - NewAuthnRequest
          - NewSignedResponse
        derived_symbols:
          - ServiceProviderSettings.GetAuthnRequest
description: |
    XML Digital Signatures generated and validated using this package use
    SHA-1, which may allow an attacker to craft inputs which cause hash
    collisions depending on their control over the input.
published: 2021-04-14T20:04:52Z
ghsas:
  - GHSA-5rhg-xhgr-5hfj
references:
  - web: https://github.com/RobotsAndPencils/go-saml/pull/38
cve_metadata:
    id: CVE-2020-36563
    cwe: 'CWE 328: Use of Weak Hash'