« Volver al listado

CVE-2020-36563

Estado: ModificadaMedia (5.3)—

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Robotsandpencils — Go-saml

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-36563",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2020-36563",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-11T16:36:49.594277Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "github.com/RobotsAndPencils/go-saml",
          "product": "github.com/RobotsAndPencils/go-saml",
          "packageName": "github.com/RobotsAndPencils/go-saml",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "affected",
          "programRoutines": [
            {
              "name": "AuthnRequest.Validate"
            },
            {
              "name": "NewAuthnRequest"
            },
            {
              "name": "NewSignedResponse"
            },
            {
              "name": "ServiceProviderSettings.GetAuthnRequest"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-12-28T03:15:09.560",
  "references": [
    {
      "url": "https://github.com/RobotsAndPencils/go-saml/pull/38",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2020-0047",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://github.com/RobotsAndPencils/go-saml/pull/38",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2020-0047",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input."
    },
    {
      "lang": "es",
      "value": "Las firmas digitales XML generadas y validadas con este paquete utilizan SHA-1, lo que puede permitir a un atacante crear entradas que provoquen colisiones de hash dependiendo de su control sobre la entrada."
    }
  ],
  "lastModified": "2026-06-17T03:15:44.717",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:robotsandpencils:go-saml:-:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "542EB65D-4341-445D-A709-FF5EAAA4A312"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@golang.org"
}