CVE-2020-29509 is a medium-severity (CVSS 5.6) CWE-115 vulnerability in github.com/russellhaering/gosaml2. A fix is available for github.com/russellhaering/gosaml2 — see the affected versions and patch details below.
Authentication Bypass in github.com/russellhaering/gosaml2
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
github.com/russellhaering/gosaml2Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Impact
Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed.
Depending on the implementation of the Service Provider this enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in the Identity Provider, or full authentication bypass.
Patches
Service Providers utilizing gosaml2 should upgrade to v0.6.0 or greater.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/russellhaering/gosaml2 | all versions | 0.6.0go get github.com/russellhaering/gosaml2@v0.6.0 |
Affected Products
gogolangtridentnetappDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/russellhaering/gosaml2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/russellhaering/gosaml2 to 0.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2020-29509 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
All uses of xml/encoding package in OpenShift Container Platform, OpenShift Jaeger, OpenShift Service Mesh (OSSM), OpenShift Virtualization and OpenShift Container Storage do not rely on XML stability. We have assigned CVE-2020-27846 for crewjam/saml, and CVE-2020-27847 for dexidp/dex Go modules which are known to…
While there is unlikely to be any fix for this issue Go's encoding/xml library affected users can workaround the vulnerability by using Mattermost's xml-roundtrip-validator [1]. [1] https://github.com/mattermost/xml-roundtrip-validatorSource: Red Hat security advisory for CVE-2020-29509 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2020-29509 in your dependencies?
Find it across Go, including transitive dependencies.