search

russellhaering / gosaml2

Pure Go implementation of SAML 2.0
Apache License 2.0
324 stars 120 forks source link

[CVE-2020-7731] CWE-476: NULL Pointer Dereference? #99

Open johakoch opened 2 years ago

johakoch commented 2 years ago

https://ossindex.sonatype.org/vulnerability/CVE-2020-7731?component-type=golang&component-name=github.com%2Frussellhaering%2Fgosaml2

This affects all versions of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.

The document mentions https://github.com/russellhaering/gosaml2/issues/59 which was fixed with https://github.com/russellhaering/gosaml2/pull/90

Maybe https://ossindex.sonatype.org/vulnerability/CVE-2020-7731?component-type=golang&component-name=github.com%2Frussellhaering%2Fgosaml2 is not up-to-date.

russellhaering commented 2 years ago

You're right, but I'm not quite sure what is causing this. The Snyk report, which the CVE seems to reference, correctly notes that this was resolved in v0.7.0.

I've opened a GitHub Security Advisory reflecting the status of this - perhaps that will propagate to the CVE?

I'll keep this open for tracking.

johakoch commented 2 years ago

Maybe, you could also Report advisory or correction for ossindex.sonatype.org.