Executive brief
Critical security issues in XML encoding in github.com/dexidp/dex
Affected products
- Go github.com/russellhaering/goxmldsig
- Go github.com/dexidp/dex
CVE identifiers
- CVE-2020-26290
- CVE-2020-27847
Junglewise Threat Intelligence
CVE-2020-26290: Critical security issues in XML encoding in github.com/dexidp/dex
CVE-2020-26290 · Severity: low · CVSS 3.1 · Published 2021-12-20
Technologies: github.com/russellhaering/goxmldsig (Go), github.com/dexidp/dex (Go). Vendors: Go.
Related threats
- GO-2026-5231 - Dex: Token-exchange endpoint is missing AllowedConnectors enforcement in github.com/dexidp/dex
- Dex: Token-exchange endpoint is missing AllowedConnectors enforcement
- Dex improper authorization in token-exchange endpoint
- russellhaering goxmldsig signature bypass in validateSignature
- GO-2024-2476 - Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex