{"action":"Upgrade github.com/crewjam/saml to 0.4.9 or later.","affected":[{"fixed":"0.4.9","introduced":"0"}],"component":"github.com/crewjam/saml","cve_ids":["CVE-2022-41912"],"ecosystem":"Go","epss":0.02325,"exploited":false,"fixed_versions":["0.4.9"],"ghsa_id":"GHSA-j2jp-wvqg-wc2g","id":"tcs_01M5KFDAQKV3JT3EGHRRXK14Z6","modified_at":"2023-11-08T04:10:35.448618Z","published_at":"2022-11-29T23:55:54Z","references":["https://osv.dev/vulnerability/GHSA-j2jp-wvqg-wc2g","https://github.com/crewjam/saml/security/advisories/GHSA-j2jp-wvqg-wc2g","https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p","https://nvd.nist.gov/vuln/detail/CVE-2022-41912","https://github.com/crewjam/saml/commit/aee3fb1edeeaf1088fcb458727e0fd863d277f8b","https://github.com/crewjam/saml","https://github.com/crewjam/saml/releases/tag/v0.4.9","https://pkg.go.dev/vuln/GO-2022-1129","http://packetstormsecurity.com/files/170356/crewjam-saml-Signature-Bypass.html"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-j2jp-wvqg-wc2g","url":"https://osv.dev/vulnerability/GHSA-j2jp-wvqg-wc2g"}],"summary":"crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication"}