CVE-2022-41912: Improper Authentication

November 28, 2022 (updated February 1, 2023)

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version.

References

github.com/advisories/GHSA-j2jp-wvqg-wc2g
github.com/crewjam/saml/commit/aee3fb1edeeaf1088fcb458727e0fd863d277f8b
github.com/crewjam/saml/releases/tag/v0.4.9
github.com/crewjam/saml/security/advisories/GHSA-j2jp-wvqg-wc2g
nvd.nist.gov/vuln/detail/CVE-2022-41912

Detect and mitigate CVE-2022-41912 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →