CVE-2020-27846

Published: Dec 21, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Affected (10)

Products: Grafana: Grafana · Saml Project: Saml · Redhat: Enterprise Linux, Openshift Container Platform, Openshift Service Mesh · +1 more

Show all products

Grafana: Grafana · Saml Project: Saml · Redhat: Enterprise Linux, Openshift Container Platform, Openshift Service Mesh · Fedoraproject: Fedora

1 product

1 product

3 products

Enterprise Linux

Openshift Container Platform

Openshift Service Mesh

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Grafana Grafana	Before 6.7.5
Grafana Grafana	From 7.0.0 to 7.2.3
Grafana Grafana	From 7.3.0 to 7.3.6

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Saml Project Saml	Before 0.4.3

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Openshift Container Platform	Version 3.11
Redhat Openshift Container Platform	Version 4.0
Redhat Openshift Service Mesh	Version 2.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Related CWEs

Misinterpretation of Input

The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.

References (14)

https://bugzilla.redhat.com/show_bug.cgi?id=1907670

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9

Source: secalert@redhat.com

Third Party Advisory

https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/

Source: secalert@redhat.com

Vendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/

Source: secalert@redhat.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/

Source: secalert@redhat.com

https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/

Source: secalert@redhat.com

ExploitThird Party Advisory

https://security.netapp.com/advisory/ntap-20210205-0002/

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1907670

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/

Source: af854a3a-2127-422b-91ae-364da2661108

https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://security.netapp.com/advisory/ntap-20210205-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.