CVE-2020-27846
Fixed in a distro release EPSS 5%
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Products: grafana, saml_project saml, redhat openshift_container_platform, redhat openshift_service_mesh, redhat enterprise_linux, fedoraproject fedora
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/crewjam/saml | 0.4.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 8 | grafana | 0:7.3.6-2.el8 |
| Red Hat Enterprise Linux 8 | grafana-debuginfo | 0:7.3.6-2.el8 |
| Rocky Linux 8 | grafana | 0:7.3.6-2.el8 |