| module: github.com/russellhaering/gosaml2 |
| versions: |
| - fixed: v0.6.0 |
| description: | |
| Due to the behavior of encoding/xml, a crafted XML document may cause |
| XML Digital Signature validation to be entirely bypassed, causing an |
| unsigned document to appear signed. |
| cves: |
| - CVE-2020-29509 |
| credit: Juho Nurminen |
| symbols: |
| - parseResponse |
| links: |
| commit: https://github.com/russellhaering/gosaml2/commit/42606dafba60c58c458f14f75c4c230459672ab9 |
| context: |
| - https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg |
