| module: github.com/dexidp/dex |
| package: github.com/dexidp/dex/connector/saml |
| versions: |
| - fixed: v0.0.0-20201214082111-324b1c886b40 |
| description: | |
| Due to the behavior of encoding/xml, a crafted XML document may cause |
| XML Digital Signature validation to be entirely bypassed, causing an |
| unsigned document to appear signed. |
| cves: |
| - CVE-2020-15216 |
| credit: Juho Nurminen (Mattermost) |
| symbols: |
| - provider.HandlePOST |
| links: |
| commit: https://github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8 |
| context: |
| - https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5 |
