Bug 1884118 (CVE-2020-15216)

Summary:	CVE-2020-15216 goxmldsig: carefully crafted XML file could allow to bypass signature validation
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	agerstmayr, alegrand, anpicker, bmontgom, eparis, erooth, go-sig, jburrell, jokerman, kakkoyun, kconner, lcosic, mgoodwin, mloibl, nathans, nstielau, pkrupa, rcernich, sponnaga, surbania
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	goxmldsig 1.1.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-10-07 14:21:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1884119
Bug Blocks:	1884121

Description Michael Kaplan 2020-10-01 06:02:45 UTC

In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0

Comment 2 Michael Kaplan 2020-10-01 06:03:05 UTC

Created golang-github-russellhaering-goxmldsig tracking bugs for this issue:

Affects: fedora-all [bug 1884119]

Comment 3 Przemyslaw Roguski 2020-10-07 11:41:08 UTC

Statement:

Whilst the OpenShift Container Platform (OCP) and OpenShift Service Mesh (OSSM) grafana container does include goxmldsig, it is only included as part of the SAML implementation. SAML is only available in the enterprise version of Grafana (https://grafana.com/docs/grafana/latest/auth/saml/). Hence the openshift4/ose-grafana and servicemesh-grafana containers have been marked as wont-fix and may be addressed in a future update.

Comment 4 Przemyslaw Roguski 2020-10-07 11:41:13 UTC

External References:

https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7

Comment 5 Product Security DevOps Team 2020-10-07 14:21:32 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-15216

Comment 6 Przemyslaw Roguski 2020-10-12 14:56:19 UTC

Upstream fix:
https://github.com/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb9615e64