CVE-2020-36563: go-saml's XML Digital Signatures use SHA-1

December 28, 2022 (updated April 11, 2025)

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input.

References

github.com/RobotsAndPencils/go-saml
github.com/RobotsAndPencils/go-saml/commit/4a1b1f5752a029e171965e0510a425d0fdd1eced
github.com/RobotsAndPencils/go-saml/pull/38
github.com/advisories/GHSA-5rhg-xhgr-5hfj
nvd.nist.gov/vuln/detail/CVE-2020-36563
pkg.go.dev/vuln/GO-2020-0047

Code Behaviors & Features

Detect and mitigate CVE-2020-36563 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →