| packages: |
| - module: github.com/russellhaering/goxmldsig |
| symbols: |
| - ValidationContext.validateSignature |
| versions: |
| - fixed: v1.1.0 |
| - module: github.com/russellhaering/gosaml2 |
| symbols: |
| - SAMLServiceProvider.validateAssertionSignatures |
| derived_symbols: |
| - SAMLServiceProvider.RetrieveAssertionInfo |
| - SAMLServiceProvider.ValidateEncodedResponse |
| versions: |
| - fixed: v0.6.0 |
| description: | |
| Due to a nil pointer dereference, a malformed XML Digital Signature |
| can cause a panic during validation. If user supplied signatures are |
| being validated, this may be used as a denial of service vector. |
| published: 2021-04-14T20:04:52Z |
| cves: |
| - CVE-2020-7711 |
| credit: '@stevenjohnstone' |
| links: |
| context: |
| - https://github.com/russellhaering/goxmldsig/issues/48 |
| - https://github.com/russellhaering/gosaml2/issues/59 |
