| id: GO-2020-0047 |
| modules: |
| - module: github.com/RobotsAndPencils/go-saml |
| vulnerable_at: 0.0.0-20170520135329-fb13cb52a46b |
| packages: |
| - package: github.com/RobotsAndPencils/go-saml |
| symbols: |
| - AuthnRequest.Validate |
| - NewAuthnRequest |
| - NewSignedResponse |
| derived_symbols: |
| - ServiceProviderSettings.GetAuthnRequest |
| summary: Weak hash (SHA-1) in github.com/RobotsAndPencils/go-saml |
| description: |- |
| XML Digital Signatures generated and validated using this package use SHA-1, |
| which may allow an attacker to craft inputs which cause hash collisions |
| depending on their control over the input. |
| published: 2021-04-14T20:04:52Z |
| ghsas: |
| - GHSA-5rhg-xhgr-5hfj |
| references: |
| - web: https://github.com/RobotsAndPencils/go-saml/pull/38 |
| cve_metadata: |
| id: CVE-2020-36563 |
| cwe: 'CWE 328: Use of Weak Hash' |
