Skip to content
OpenAdvisories

Vendor

crewjam

3 known vulnerabilities.

Products

saml 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2023-45683

    Cross site scripting via missing binding syntax validation In ACS location in github.com/crewjam/saml

    github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at…

    crewjam saml github.com/crewjam/saml golang-github-crewjam-saml Ubuntu Go
  • High 7.5
    CVE-2023-28119

    crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb

    The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to…

    crewjam saml github.com/crewjam/saml golang-github-crewjam-saml Ubuntu Go