CVE-2020-26290 json
Critical security issues in XML encoding in Dex
published 5y ago modified last mo. also CVE-2020-27847 , GHSA-2x32-jm95-2cpx , GHSA-m9hp-7r99-94h5 , EUVD-2021-2551
- cvss
- 9.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).
Patch / fix
- go github.com/dexidp/dex 2.27.0
- go github.com/russellhaering/goxmldsig 1.1.0
- linuxfoundation dex 2.27.0
- dex-oidc openSUSE Tumbleweed 2.28.1-1.3
opensuse advisories openSUSE-SU-2024:10714-1
Is CVE-2020-26290 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
0.99% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
| NVD | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/dexidp/dex | <2.27.0 |
2.27.0 |
| go | github.com/russellhaering/goxmldsig | <1.1.0 |
1.1.0 |
Affected products
- dexidp dex
Classification
References
-
github.com
/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8
web, patch, third-party-advisory
-
github.com
/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb9615e64
web
-
github.com
/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
web, not-applicable, third-party-advisory
-
github.com
/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md
web, not-applicable, third-party-advisory
-
github.com
/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md
web, not-applicable, third-party-advisory
-
mattermost.com
/blog/coordinated-disclosure-go-xml-vulnerabilities/
not-applicable, third-party-advisory
-
github.com
/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5
web, third-party-advisory
-
github.com
/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7
web, not-applicable, third-party-advisory
-
github.com
/dexidp/dex/releases/tag/v2.27.0
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-26290
advisory
-
mattermost.com
/blog/coordinated-disclosure-go-xml-vulnerabilities
web
-
pkg.go.dev
/vuln/GO-2020-0050
web
-
nvd.nist.gov
/vuln/detail/CVE-2020-27847
advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=1907732
web
Sources
- CVE List CVE-2020-26290
- GitHub Advisory GHSA-m9hp-7r99-94h5
- GitHub Advisory GHSA-2x32-jm95-2cpx
- NVD CVE-2020-26290
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.