crítica
CVE-2020-27846
crewjam/saml: authentication bypass in saml authentication
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Red Hat, Bitnami. Más baja según Oracle (media), Rocky Linux (media).
Descripción
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | grafana | 6.7.5, 7.2.3, 7.3.6 |
| go::GitHub Security Advisory Go | github.com/crewjam/saml | 0.4.3 |
| Red Hat | servicemesh-grafana, servicemesh-grafana-prometheus | sin corrección indicada |
| Oracle Linux 8 | grafana | 7.3.6-2.el8 |
| rocky 8 | grafana | 7.3.6-2.el8 |
Mostrar las 6 entradas de 5 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | grafana | 6.7.5, 7.2.3, 7.3.6 |
| go::GitHub Security Advisory Go | github.com/crewjam/saml | 0.4.3 |
| Red Hat | servicemesh-grafana | sin corrección indicada |
| Red Hat | servicemesh-grafana-prometheus | sin corrección indicada |
| Oracle Linux 8 | grafana | 7.3.6-2.el8 |
| rocky 8 | grafana | 7.3.6-2.el8 |
Referencias
- https://access.redhat.com/errata/RHSA-2021:1859
- https://access.redhat.com/security/cve/CVE-2020-27846
- https://bugzilla.redhat.com/show_bug.cgi?id=1843170
- https://bugzilla.redhat.com/show_bug.cgi?id=1850471
- https://bugzilla.redhat.com/show_bug.cgi?id=1892418
- https://bugzilla.redhat.com/show_bug.cgi?id=1907670
- https://bugzilla.redhat.com/show_bug.cgi?id=1916083
- https://creativecommons.org/licenses/by/4.0/
Las 29 referencias
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24303
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27846
- https://errata.rockylinux.org/RLSA-2021:1859
- https://github.com/crewjam/saml
- https://github.com/crewjam/saml/commit/da4f1a0612c0a8dd0452cf8b3c7a6518f6b4d053
- https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9
- https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise
- https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/
- https://linux.oracle.com/cve/CVE-2020-27846.html
- https://linux.oracle.com/errata/ELSA-2021-1859.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
- https://nvd.nist.gov/vuln/detail/CVE-2020-27846
- https://pkg.go.dev/vuln/GO-2021-0058
- https://security.netapp.com/advisory/ntap-20210205-0002
- https://security.netapp.com/advisory/ntap-20210205-0002/
- https://www.cve.org/CVERecord?id=CVE-2020-27846