Vulnerability · Published May 28, 2021 · Assigned by redhat
CVE-2020-27847
Critical 9.8
In plain English
A critical-severity security flaw in dexidp/dex. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.7%top 22.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/dexidp/dex | 2.27.0 | GHSA-2x32-jm95-2cpx |
| Go | github.com/dexidp/dex | 2.27.0 | GHSA-m9hp-7r99-94h5 |
| Go | github.com/russellhaering/goxmldsig | 1.1.0 | GHSA-m9hp-7r99-94h5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | dexidp/dex | dex 2.27.0 |
Weakness: CWE-228
References
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=1907732 x_refsource_MISC
- https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5 x_refsource_MISC