Impact

The following vulnerabilities have been disclosed, which impact users leveraging the SAML connector:

Signature Validation Bypass (CVE-2020-15216): GHSA-q547-gmf8-8jr7

encoding/xml instabilities:

• Element namespace prefix instability (CVE-2020-29511)
• Attribute namespace prefix instability (CVE-2020-29509)
• Directive comment instability (CVE-2020-29510)

Patches

Immediately update to Dex v2.27.0.

Workarounds

There are no known workarounds.

References

• GHSA-m9hp-7r99-94h5
• GHSA-q547-gmf8-8jr7
• https://nvd.nist.gov/vuln/detail/CVE-2020-26290
• dexidp/dex@324b1c8
• https://github.com/dexidp/dex/releases/tag/v2.27.0
• https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md
• https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
• https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md
• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
• russellhaering/goxmldsig@f6188fe
• https://pkg.go.dev/vuln/GO-2020-0050