Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2020-7711: goxmldsig Crashes When Processing Malformed XML Signatures
CVE-2020-7711 · published 6 years ago
Summary
All versions of goxmldsig are affected. If a maliciously crafted XML signature is received, the program may crash. Update to a fixed version to prevent this crash.
What to do
- Update github.com russellhaering to version 1.1.1.
- Update github.com russellhaering to version 0.7.0.
- Update debian golang-github-russellhaering-goxmldsig to version 1.1.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | russellhaering |
< 1.1.1 Fix: upgrade to 1.1.1
|
| go | github.com | russellhaering |
< 0.7.0 Fix: upgrade to 0.7.0
|
| – | goxmldsig_project | goxmldsig |
All versions
cpe:2.3:a:goxmldsig_project:goxmldsig:*:*:*:*:*:*:*:* |
| Ubuntu:18.04:LTS | canonical | golang-github-russellhaering-goxmldsig | All versions |
| Debian:12 | debian | golang-github-russellhaering-goxmldsig |
< 1.1.1-1 Fix: upgrade to 1.1.1-1
|
Original advisory text
This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.
This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-7711
- https://pkg.go.dev/vuln/GO-2020-0046
- https://github.com/russellhaering/gosaml2/issues/59
- https://github.com/advisories/GHSA-mqqv-chpx-vq25
- https://ubuntu.com/security/CVE-2020-7711 Third Party Advisory
- https://github.com/russellhaering/goxmldsig/issues/48 Third Party Advisory
- https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMRUSSELLHAERINGGOXMLDSIG-608301 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-7711 Third Party Advisory
- https://github.com/russellhaering/goxmldsig/pull/71 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2020-7711 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-476NULL Pointer Dereference
Timeline
Published23 Aug 2020
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-mqqv-chpx-vq25 · GHSA
CVE-2020-7711 · NVD
UBUNTU-CVE-2020-7711 · OSV
DEBIAN-CVE-2020-7711 · OSV
Track software like this
Free during beta