critique
CVE-2020-27846
crewjam/saml: authentication bypass in saml authentication
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA, Red Hat, Bitnami. Plus basse selon Oracle (moyenne), Rocky Linux (moyenne).
Description
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | grafana | 6.7.5, 7.2.3, 7.3.6 |
| go::GitHub Security Advisory Go | github.com/crewjam/saml | 0.4.3 |
| Red Hat | servicemesh-grafana, servicemesh-grafana-prometheus | pas de correctif indiqué |
| Oracle Linux 8 | grafana | 7.3.6-2.el8 |
| rocky 8 | grafana | 7.3.6-2.el8 |
Afficher les 6 entrées de 5 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | grafana | 6.7.5, 7.2.3, 7.3.6 |
| go::GitHub Security Advisory Go | github.com/crewjam/saml | 0.4.3 |
| Red Hat | servicemesh-grafana | pas de correctif indiqué |
| Red Hat | servicemesh-grafana-prometheus | pas de correctif indiqué |
| Oracle Linux 8 | grafana | 7.3.6-2.el8 |
| rocky 8 | grafana | 7.3.6-2.el8 |
Références
- https://access.redhat.com/errata/RHSA-2021:1859
- https://access.redhat.com/security/cve/CVE-2020-27846
- https://bugzilla.redhat.com/show_bug.cgi?id=1843170
- https://bugzilla.redhat.com/show_bug.cgi?id=1850471
- https://bugzilla.redhat.com/show_bug.cgi?id=1892418
- https://bugzilla.redhat.com/show_bug.cgi?id=1907670
- https://bugzilla.redhat.com/show_bug.cgi?id=1916083
- https://creativecommons.org/licenses/by/4.0/
Les 29 références
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24303
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27846
- https://errata.rockylinux.org/RLSA-2021:1859
- https://github.com/crewjam/saml
- https://github.com/crewjam/saml/commit/da4f1a0612c0a8dd0452cf8b3c7a6518f6b4d053
- https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9
- https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise
- https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/
- https://linux.oracle.com/cve/CVE-2020-27846.html
- https://linux.oracle.com/errata/ELSA-2021-1859.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
- https://nvd.nist.gov/vuln/detail/CVE-2020-27846
- https://pkg.go.dev/vuln/GO-2021-0058
- https://security.netapp.com/advisory/ntap-20210205-0002
- https://security.netapp.com/advisory/ntap-20210205-0002/
- https://www.cve.org/CVERecord?id=CVE-2020-27846