Description
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | crewjam/saml | grafana-7.3.6, grafana-7.2.3, grafana-6.7.5, github.com/crewjam/saml-0.4.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | grafana | 7.3.6-2.el8 | RHSA-2021:1859 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | grafana | 7.3.6-2.el8 | RLSA-2021:1859 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | grafana | 7.3.6-2.el8 | ELSA-2021-1859 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/crewjam/saml | < 0.4.3 | 0.4.3 | GHSA-4hq8-gmxx-h6w9 |
Advisories 4
- VDE-2026-049 Balluff GmbH: Multiple Vulnerabilities Affecting BNI EGW-720-007-K095 and BAV MA-NC-00025-01 CERT@VDE · Jun 30, 2026
- RHSA-2021:1859 Red Hat Security Advisory: grafana security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Mar 27, 2026
- RLSA-2021:1859 Moderate: grafana security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- ELSA-2021-1859 Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 25, 2021
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1907670
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
- https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9
- https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/
- FEDORA-2020-968067abfa vendor-advisory
- FEDORA-2020-64e54abd9f vendor-advisory
- https://security.netapp.com/advisory/ntap-20210205-0002/