CVE-2020-29510 — Misinterpretation of Input in Dexidp DEX

CWE-115 — Misinterpretation of InputCWE-347 — Improper Verification of Cryptographic Signature9 documents8 sources
Severity
5.6MEDIUMNVD
CNA9.8GHSA6.5OSV6.5
EPSS
0.1%
top 68.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Github.com Dexidp DEXGithub.com Russellhaering GoxmldsigGolang GO+1 more
Timeline
PublishedDec 14
Latest updateMay 24

Description

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 2.2 | Impact: 3.4

Affected Packages5 packages

▶CVEListV5golang/gounspecified — 1.15
▶NVDgolang/go1.15

🔴Vulnerability Details

5
GHSA
GHSA-p6mv-vmpw-j23r: The encoding/xml package in Go versions 1↗2022-05-24
▶
GHSA
Critical security issues in XML encoding in github.com/dexidp/dex↗2021-12-20
▶
OSV
Critical security issues in XML encoding in github.com/dexidp/dex↗2021-12-20
▶
OSV
CVE-2020-29510: The encoding/xml package in Go versions 1↗2020-12-14
▶
CVEList
CVE-2020-29510: The encoding/xml package in Go versions 1↗2020-12-14
▶

📋Vendor Advisories

3
Palo Alto
PAN-SA-2021-0001 Informational: Cortex XSOAR: Impact of Golang XML parsing vulnerabilities↗2021-01-13
▶
Red Hat
go: encoding/xml: XML directives instability↗2020-12-14
▶
Debian
CVE-2020-29510: golang-1.15 - The encoding/xml package in Go versions 1.15 and earlier does not correctly pres...↗2020
▶
CVE-2020-29510 — Misinterpretation of Input | cvebase