Log in Start free

Vulnerability · Published Aug 23, 2020 · Assigned by snyk

CVE-2020-7711Denial of Service (DoS)

High 7.5

In plain English

A high-severity security flaw in github.com/russellhaering/goxmldsig. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.8%top 21.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-github-russellhaering-goxmldsig1.1.1-1DEBIAN-CVE-2020-7711
Gogithub.com/russellhaering/gosaml20.7.0GHSA-gq5r-cc4w-g8xf
Gogithub.com/russellhaering/gosaml20.7.0GHSA-mqqv-chpx-vq25
Gogithub.com/russellhaering/gosaml20.7.0GHSA-prjq-f4q3-fvfr
Gogithub.com/russellhaering/gosaml20.7.0GO-2020-0046
Gogithub.com/russellhaering/goxmldsig1.1.1GHSA-prjq-f4q3-fvfr
Gogithub.com/russellhaering/goxmldsig1.1.1GO-2020-0046
Gogithub.com/russellhaering/goxmldsig1.1.1GHSA-mqqv-chpx-vq25
Gogithub.com/russellhaering/goxmldsig1.1.1GHSA-gq5r-cc4w-g8xf
Ubuntu:22.04:LTSgolang-github-russellhaering-goxmldsigno fix listedUBUNTU-CVE-2020-7711
Ubuntu:24.04:LTSgolang-github-russellhaering-goxmldsigno fix listedUBUNTU-CVE-2020-7711
Ubuntu:25.10golang-github-russellhaering-goxmldsigno fix listedUBUNTU-CVE-2020-7711
Ubuntu:26.04:LTSgolang-github-russellhaering-goxmldsigno fix listedUBUNTU-CVE-2020-7711
Ubuntu:26.10golang-github-russellhaering-goxmldsigno fix listedUBUNTU-CVE-2020-7711

Affected products (as reported)

VendorProductVersions
n/a github.com/russellhaering/goxmldsig 0 – before unspecified

References