| id: GO-2023-1664 |
| modules: |
| - module: github.com/crewjam/saml |
| versions: |
| - fixed: 0.4.13 |
| vulnerable_at: 0.4.12 |
| packages: |
| - package: github.com/crewjam/saml |
| symbols: |
| - NewIdpAuthnRequest |
| - ServiceProvider.ValidateLogoutResponseRedirect |
| derived_symbols: |
| - IdentityProvider.ServeSSO |
| - ServiceProvider.ValidateLogoutResponseRequest |
| summary: Denial of service via deflate compression bomb in github.com/crewjam/saml |
| cves: |
| - CVE-2023-28119 |
| ghsas: |
| - GHSA-5mqj-xc49-246p |
| credits: |
| - '@nszetei' |
| references: |
| - advisory: https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246p |
| - fix: https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021 |
