Skip to content
Fencer Vulns
critical 9.8

CVE-2020-29509 json

Authentication Bypass in github.com/russellhaering/gosaml2

published 2020-12-14 5 y ago modified 2026-09-10 59 d ago also BIT-golang-2020-29509 , EUVD-2022-1254 , GHSA-xhqq-x44f-9fgg , GO-2021-0060

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

Patch / fix

  • go github.com/russellhaering/gosaml2 0.6.0
  • bitnami golang 1.17.0
  • golang go 1.17
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 1.17-r0

alpine advisories ALPINE-CVE-2020-29509

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0 1.20.10-1

azure linux advisories AZL-6448

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • go Arch Linux 2:1.17-1
  • mattermost Arch Linux 5.26.2-1

arch linux advisories AVG-1357AVG-1358

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-29509 updated cvss 5.6

go: encoding/xml: XML attribute instability

  • Red Hat Enterprise Linux 7 golang, golang-bin, golang-src, golang-misc, golang-tests Red Hat Enterprise Linux 8 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +1 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Distributed Tracing Jaeger 1 distributed-tracing/jaeger-rhel7-operator, distributed-tracing/jaeger-rhel8-operator, distributed-tracing/jaeger-collector-rhel7, distributed-tracing/jaeger-collector-rhel8, distributed-tracing/jaeger-all-in-one-rhel7, distributed-tracing/jaeger-all-in-one-rhel8 Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-istioctl, servicemesh-operator, servicemesh-prometheus, +2 more Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +19 more Red Hat OpenShift Container Platform 4 openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, openshift-kube-apiserver, openshift-kube-scheduler, +3 more Red Hat Openshift Container Storage 4 ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/ocs-must-gather-rhel8, ocs4/rook-ceph-rhel8-operator Red Hat OpenShift Virtualization 2 kubemacpool-container, bridge-marker-container, ovs-cni-marker-container, ovs-cni-plugin-container, virt-cdi-cloner-container, virt-cdi-importer-container, +14 more
    +1 more products
    Red Hat Storage 3 heketi, heketi-client, python-heketi
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.10% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/russellhaering/gosaml2
<0.6.0
0.6.0
bitnami golang
<1.17.0
1.17.0

Affected products

  • Golang Go

Classification

Weakness
  • CWE-115 Misinterpretation of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.