Go/github.com/ssoready/ssoready CVE-2024-47832: critical 9.8, EPSS 0.40%

SSOReady has an XML Signature Bypass via differential XML parsing

Action: Upgrade github.com/ssoready/ssoready to 0.0.0-20241009153838-7f92a0630439 or later.

go get github.com/ssoready/ssoready@v0.0.0-20241009153838-7f92a0630439

Affected

Fixed versions

Sources

• osv: GHSA-j2hr-q93x-gxvh
• https://github.com/ssoready/ssoready/security/advisories/GHSA-j2hr-q93x-gxvh
• https://nvd.nist.gov/vuln/detail/CVE-2024-47832
• https://github.com/ssoready/ssoready/commit/7f92a0630439972fcbefa8c7eafe8c144bd89915
• https://github.com/ssoready/ssoready
• https://pkg.go.dev/vuln/GO-2024-3185
• https://ssoready.com/docs/self-hosting/self-hosting-sso-ready

CVE-2024-47832 · published 2024-10-11T16:58:36Z · modified 2024-10-11T16:58:37Z · JSON