Vulnerability · Published Mar 22, 2023 · Assigned by GitHub_M
CVE-2023-28119crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb
High 7.5
In plain English
A high-severity resource allocation without limits in saml from crewjam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/crewjam/saml | 0.4.13 | GO-2023-1664 |
| Go | github.com/crewjam/saml | 0.4.13 | GHSA-5mqj-xc49-246p |
| Ubuntu:22.04:LTS | golang-github-crewjam-saml | no fix listed | UBUNTU-CVE-2023-28119 |
| Ubuntu:24.04:LTS | golang-github-crewjam-saml | no fix listed | UBUNTU-CVE-2023-28119 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H