CVE-2020-27846: XML Processing error in github.com/crewjam/saml
Summary
CVE-2020-27846: Signature validation bypass due to XML processing error in github.com/crewjam/saml. Affects github.com/crewjam/saml versions < 0.4.3. Fixed in 0.4.3. How to fix ↓
Also tracked for
- grafana · Bitnami
The same CVE-2020-27846 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/crewjam/saml is written in Go and is used for processing XML documents. It provides functionality for parsing and validating XML data. However, it is vulnerable to three specific vulnerabilities in the go encoding/xml package. These vulnerabilities can allow an attacker to forge part of a signed XML document, potentially leading to unauthorized access or manipulation of sensitive information.
Vulnerability Detail
The vulnerabilities in the go encoding/xml package can be exploited by an attacker to manipulate signed XML documents. This can result in various security risks, such as unauthorized access, data tampering, or impersonation attacks. The vulnerabilities stem from improper validation of XML input, allowing an attacker to inject malicious content into the XML document. This can bypass the intended security measures and compromise the integrity and authenticity of the document.
How To Fix
Latest published version: v0.5.1 as of 23 Oct 2026
go get github.com/crewjam/saml@v0.5.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.3
This is the first release that contains the fix.
go get github.com/crewjam/saml@v0.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerabilities in the go encoding/xml package used by github.com/crewjam/saml can allow an attacker to forge part of a signed XML document, potentially leading to unauthorized access or manipulation of sensitive information. To mitigate these vulnerabilities, it is crucial to update the package to version 0.4.3 or later. This ensures that XML input is properly validated, preventing the exploitation of these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/crewjam/saml →
FAQ
The vulnerabilities can allow an attacker to forge part of a signed XML document, potentially leading to unauthorized access, data tampering, or impersonation attacks.
To protect your application, it is crucial to update the github.com/crewjam/saml package to version 0.4.3 or later. This ensures that the XML processing is secure and prevents the exploitation of these vulnerabilities.
There are no known instances of these vulnerabilities being exploited in the wild. However, it is important to proactively update the package to prevent any potential attacks.
No, the vulnerabilities can only be fully mitigated by updating the github.com/crewjam/saml package to version 0.4.3 or later. This update ensures proper validation of XML input, preventing the exploitation of these vulnerabilities.
In addition to updating the package, it is recommended to follow secure coding practices and implement other security measures, such as input validation and output encoding, to further protect your application from potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/crewjam/saml.
