Bug 1884118 (CVE-2020-15216) - CVE-2020-15216 goxmldsig: carefully crafted XML file could allow to bypass signature validation
Summary: CVE-2020-15216 goxmldsig: carefully crafted XML file could allow to bypass si...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2020-15216
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1884119
Blocks: 1884121
TreeView+ depends on / blocked
 
Reported: 2020-10-01 06:02 UTC by Michael Kaplan
Modified: 2021-02-16 19:11 UTC (History)
20 users (show)

Fixed In Version: goxmldsig 1.1.0
Clone Of:
Environment:
Last Closed: 2020-10-07 14:21:32 UTC
Embargoed:

Attachments (Terms of Use)

Description Michael Kaplan 2020-10-01 06:02:45 UTC 
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0
Comment 2 Michael Kaplan 2020-10-01 06:03:05 UTC 
Created golang-github-russellhaering-goxmldsig tracking bugs for this issue:

Affects: fedora-all [bug 1884119]
Comment 3 Przemyslaw Roguski 2020-10-07 11:41:08 UTC 
Statement:

Whilst the OpenShift Container Platform (OCP) and OpenShift Service Mesh (OSSM) grafana container does include goxmldsig, it is only included as part of the SAML implementation. SAML is only available in the enterprise version of Grafana (https://grafana.com/docs/grafana/latest/auth/saml/). Hence the openshift4/ose-grafana and servicemesh-grafana containers have been marked as wont-fix and may be addressed in a future update.
Comment 4 Przemyslaw Roguski 2020-10-07 11:41:13 UTC 
External References:

https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7
Comment 5 Product Security DevOps Team 2020-10-07 14:21:32 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-15216
Comment 6 Przemyslaw Roguski 2020-10-12 14:56:19 UTC 
Upstream fix:
https://github.com/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb9615e64
Note You need to log in before you can comment on or make changes to this bug.