CVE-2020-26290

CRITICAL9.3EPSS 0.50%

Critical security issues in XML encoding in github.com/dexidp/dex

發布日:2021/12/20修改日:2026/3/13

描述

### Impact The following vulnerabilities have been disclosed, which impact users leveraging the SAML connector: Signature Validation Bypass (CVE-2020-15216): https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7 `encoding/xml` instabilities: - [Element namespace prefix instability (CVE-2020-29511)](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md) - [Attribute namespace prefix instability (CVE-2020-29509)](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md) - [Directive comment instability (CVE-2020-29510)](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md) ### Patches Immediately update to [Dex v2.27.0](https://github.com/dexidp/dex/releases/tag/v2.27.0). ### Workarounds There are no known workarounds.

受影響套件(2)

Go/github.com/dexidp/dexfrom 0, < 2.27.0
Go/github.com/russellhaering/goxmldsigfrom 0, < 1.1.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

描述

受影響套件(2)

CVSS 分數

參考連結(11)