| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/crewjam/saml | < 0.4.3 | 0.4.3 |
| grafana | ≥ 7.0.0, < 7.2.3≥ 7.3.0, < 7.3.6< 6.7.5 | 7.2.37.3.66.7.5 |
| openshift container platform | = 3.11= 4.0 | |
| openshift service mesh | = 2.0 | |
| saml | < 0.4.3 | 0.4.3 |
There are three vulnerabilities in the go encoding/xml package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see xml-roundtrip-validator
In version 0.4.3, all XML input is validated prior to being parsed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free