ByteOS Network

Vulnerability Details :

CVE-2020-27846

Assigner-redhat

Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749

Published At-21 Dec, 2020 | 15:16

Updated At-04 Aug, 2024 | 16:25

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:redhat

Assigner Org ID:53f830b8-0a3f-465b-8143-3b8a9948e749

Published At:21 Dec, 2020 | 15:16

Updated At:04 Aug, 2024 | 16:25

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

crewjam/saml

Versions

Affected

grafana-7.3.6, grafana-7.2.3, grafana-6.7.5, github.com/crewjam/saml-0.4.3

Problem Types

Type	CWE ID	Description
CWE	CWE-115	CWE-115

Type: CWE

CWE ID: CWE-115

Description: CWE-115

References

Hyperlink	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1907670	x_refsource_MISC
https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/	x_refsource_MISC
https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9	x_refsource_MISC
https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/	vendor-advisory x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/	vendor-advisory x_refsource_FEDORA
https://security.netapp.com/advisory/ntap-20210205-0002/	x_refsource_CONFIRM

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1907670

Resource:

x_refsource_MISC

Hyperlink: https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/

Resource:

x_refsource_MISC

Hyperlink: https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9

Resource:

x_refsource_MISC

Hyperlink: https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/

Resource:

x_refsource_MISC

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: https://security.netapp.com/advisory/ntap-20210205-0002/

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1907670	x_refsource_MISC x_transferred
https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/	x_refsource_MISC x_transferred
https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9	x_refsource_MISC x_transferred
https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/	x_refsource_MISC x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/	vendor-advisory x_refsource_FEDORA x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/	vendor-advisory x_refsource_FEDORA x_transferred
https://security.netapp.com/advisory/ntap-20210205-0002/	x_refsource_CONFIRM x_transferred

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1907670

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/

Resource:

vendor-advisory

x_refsource_FEDORA

x_transferred

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/

Resource:

vendor-advisory

x_refsource_FEDORA

x_transferred

Hyperlink: https://security.netapp.com/advisory/ntap-20210205-0002/

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert@redhat.com

Published At:21 Dec, 2020 | 16:15

Updated At:07 Nov, 2023 | 03:21

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 10.0

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

Grafana Labs

>>grafana>>Versions before 6.7.5(exclusive)

cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*

Grafana Labs

>>grafana>>Versions from 7.0.0(inclusive) to 7.2.3(exclusive)

cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*

Grafana Labs

>>grafana>>Versions from 7.3.0(inclusive) to 7.3.6(exclusive)

cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*

saml_project>>saml>>Versions before 0.4.3(exclusive)

cpe:2.3:a:saml_project:saml:*:*:*:*:*:*:*:*

Red Hat, Inc.

>>openshift_container_platform>>3.11

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

Red Hat, Inc.

>>openshift_container_platform>>4.0

cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>openshift_service_mesh>>2.0

cpe:2.3:a:redhat:openshift_service_mesh:2.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux>>8.0

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Fedora Project

>>fedora>>32

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Fedora Project

>>fedora>>33

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*