Vulnerability · Published Dec 28, 2020 · Assigned by GitHub_M

CVE-2020-26290Critical security issues in XML encoding in Dex

Critical 9.3

In plain English

A critical-severity security flaw in dex from dexidp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)1.0%top 37.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/dexidp/dex	2.27.0	GHSA-2x32-jm95-2cpx
Go	github.com/dexidp/dex	2.27.0	GHSA-m9hp-7r99-94h5
Go	github.com/russellhaering/goxmldsig	1.1.0	GHSA-m9hp-7r99-94h5

Affected products (as reported)

Vendor	Product	Versions
dexidp	dex	< 2.27.0

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References

https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md x_refsource_MISC
https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md x_refsource_MISC
https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md x_refsource_MISC
https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ x_refsource_MISC
https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5 x_refsource_CONFIRM
https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7 x_refsource_MISC
https://github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8 x_refsource_MISC
https://github.com/dexidp/dex/releases/tag/v2.27.0 x_refsource_MISC