CVE-2020-36563: Weak hash (SHA-1) in github.com/RobotsAndPencils/go-saml
Summary
CVE-2020-36563: Weak hash (SHA-1) in github.com/RobotsAndPencils/go-saml. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/RobotsAndPencils/go-saml is a Go library that provides functionality for generating and validating XML Digital Signatures. It is commonly used for implementing SAML (Security Assertion Markup Language) authentication in Go applications. The package offers functions such as AuthnRequest.Validate, NewAuthnRequest, NewSignedResponse, and ServiceProviderSettings.GetAuthnRequest.
Vulnerability Detail
The vulnerability (CVE-2020-36563) in github.com/RobotsAndPencils/go-saml arises from the use of a weak hash algorithm, SHA-1, for generating and validating XML Digital Signatures. This can allow an attacker to craft inputs that result in hash collisions, depending on their control over the input. Hash collisions can lead to various security issues, such as impersonation attacks, data integrity violations, and unauthorized access to sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can modify the package code to replace the usage of SHA-1 with a stronger hash algorithm. Here is an example of how to replace SHA-1 with SHA-256 in the AuthnRequest.Validate function:
import (
"crypto/sha256"
"encoding/base64"
)
func (ar *AuthnRequest) Validate() error {
// Existing code using SHA-1
hash := sha1.Sum([]byte(ar.ID))
// Replace with SHA-256
hash := sha256.Sum256([]byte(ar.ID))
// ...
}
Conclusion
In conclusion, the package github.com/RobotsAndPencils/go-saml is vulnerable to a weak hash (SHA-1) vulnerability (CVE-2020-36563). This vulnerability can be mitigated by updating the package to a version that uses a stronger hash algorithm or by modifying the package code to use a stronger hash algorithm as a temporary workaround. It is recommended to stay updated with the latest patched version and regularly check for vulnerabilities using tools like Vulert. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/RobotsAndPencils/go-saml →
FAQ
The vulnerability allows an attacker to craft inputs that result in hash collisions, which can lead to various security issues such as impersonation attacks, data integrity violations, and unauthorized access to sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file and Vulert will analyze it for open-source vulnerabilities, including this one.
The package maintainers should release a patched version that addresses this vulnerability. It is recommended to update your dependencies to the latest patched version once it becomes available.
As a temporary workaround, you can modify the package code to replace the usage of SHA-1 with a stronger hash algorithm, such as SHA-256 or SHA-3. However, it is highly recommended to update to the latest patched version once it becomes available.
There are currently no known exploits for this vulnerability. However, it is important to address this vulnerability promptly to prevent any potential security incidents.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/RobotsAndPencils/go-saml.
