Description
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a crewjam/saml
grafana-7.3.6, grafana-7.2.3, grafana-6.7.5, github.com/crewjam/saml-0.4.3affected
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1907670 ↗
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ ↗
- https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9 ↗
- https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/ ↗
- https://security.netapp.com/advisory/ntap-20210205-0002/ ↗