Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/crewjam/saml

5 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 1 critical, 2 high
Registry
pkg.go.dev

Advisories 5

  • Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

    Affected: all versions.

  • Cross site scripting via missing binding syntax validation In ACS location in github.com/crewjam/saml

    Affected: fixed in 0.4.14.

  • crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb

    Affected: fixed in 0.4.13.

  • CVE-2022-41912Critical 9.1

    crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements

    Affected: fixed in 0.4.9.

  • A signature verification vulnerability exists in crewjam/saml.

    Affected: fixed in 0.4.3.