Go modules package
github.com/crewjam/saml
pkg:golang/github.com/crewjam/saml
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-45683 | — | < 0.4.14 | 0.4.14 | Oct 16, 2023 | github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject J | ||
| CVE-2023-28119 | — | < 0.4.13 | 0.4.13 | Mar 22, 2023 | The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing funct | ||
| CVE-2022-41912 | — | < 0.4.9 | 0.4.9 | Nov 28, 2022 | The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version. | ||
| CVE-2020-27846 | — | < 0.4.3 | 0.4.3 | Dec 21, 2020 | A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. |
- CVE-2023-45683Oct 16, 2023affected < 0.4.14fixed 0.4.14
github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject J
- CVE-2023-28119Mar 22, 2023affected < 0.4.13fixed 0.4.13
The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing funct
- CVE-2022-41912Nov 28, 2022affected < 0.4.9fixed 0.4.9
The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version.
- CVE-2020-27846Dec 21, 2020affected < 0.4.3fixed 0.4.3
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.