CVE-2020-26290 — Improper Verification of Cryptographic Signature in DEX

CWE-347 — Improper Verification of Cryptographic Signature4 documents4 sources
Severity
9.6CRITICALNVD
CNA9.3GHSA6.5OSV6.5
EPSS
0.5%
top 34.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Dexidp DEXGithub.com Dexidp DEXGithub.com Russellhaering Goxmldsig+1 more
Timeline
PublishedDec 28
Latest updateDec 20

Description

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HExploitability: 2.8 | Impact: 6.0

Affected Packages4 packages

▶CVEListV5dexidp/dex< 2.27.0
▶NVDlinuxfoundation/dex< 2.27.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
Critical security issues in XML encoding in github.com/dexidp/dex↗2021-12-20
▶
OSV
Critical security issues in XML encoding in github.com/dexidp/dex↗2021-12-20
▶
CVEList
Critical security issues in XML encoding in Dex↗2020-12-28
▶
CVE-2020-26290 — Dexidp DEX vulnerability | cvebase