CVE-2020-26290
Critical
Description
Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).
SeverityCritical
CVSS9.3
Exploit probability—
ProductLinuxfoundation Dex
PublishedDec 28, 2020
First seenDec 28, 2020
Weakness typeCWE-347CWE-347
How to fix
Update
- linuxfoundation dex2.27.0 or later
- github.com/dexidp/dex2.27.0 or later
- github.com/russellhaering/goxmldsig1.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation dex | v < 2.27.0 | 2.27.0 |
| github.com/dexidp/dexGo | v < 2.27.0 | 2.27.0 |
| github.com/russellhaering/goxmldsigGo | v < 1.1.0 | 1.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.