-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commit diff shows the vulnerable code was in validateAssertionSignatures' callback function where unverifiedAssertion.Parent() was accessed without nil-check. The patch added a parent == nil guard clause to prevent dereferencing. The CWE-476 classification and crash reports confirm this pattern matches NULL Pointer Dereference vulnerabilities. The added test TestMalFormedInput specifically validates this fix by triggering the parent nil scenario.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/russellhaering/gosaml2 | go | < 0.7.0 | 0.7.0 |
| github.com/russellhaering/goxmldsig | go | < 1.1.1 | 1.1.1 |