CVE-2020-29509 is a medium-severity vulnerability affecting the encoding/xml package in all versions of Go, including products like NetApp Go and Trident. It allows attackers to craft XML inputs that behave inconsistently during processing due to incorrect preservation of attribute namespace prefixes, potentially leading to authentication bypasses as seen in SAML. While there is no known active exploitation or public exploit code, the vulnerability has garnered some community and media attention, indicating its potential impact.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.17CPE matchmatch criteria | cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:trident:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Authentication Bypass in github.com/russellhaering/gosaml2
Feb 11, 2022go: encoding/xml: XML attribute instability
Dec 14, 2020The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
Dec 8, 2020