CVE-2022-41912: crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements
An authentication bypass flaw was discovered in the crewjam/saml go package. A remote unauthenticated attacker could trigger it by sending a SAML request. This would allow an escalation of privileges and then enable compromising system integrity.
Other sources
The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/crewjam/samlto a version that resolves this vulnerability.Fixed in 0.4.9 - Upgrade
Upgrade
crewjam/saml go packageto a version that resolves this vulnerability.Fixed in 0.4.9
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-41912?
CVE-2022-41912 is an authentication bypass flaw in the crewjam/saml go package.
What is the severity of CVE-2022-41912?
CVE-2022-41912 has a severity rating of 9.1 (critical).
How does CVE-2022-41912 affect the crewjam/saml go library?
CVE-2022-41912 affects the crewjam/saml go library prior to version 0.4.9.
How can I fix CVE-2022-41912?
To fix CVE-2022-41912, upgrade to version 0.4.9 of the crewjam/saml go library.
Are there any workarounds for CVE-2022-41912?
No, there are no workarounds for CVE-2022-41912 other than upgrading to version 0.4.9.