{"id":"CVE-2023-28119","published":"2023-03-22T19:51:13Z","modified":"2025-02-25T14:51:31Z","title":"crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb","vendor":"crewjam","product":"saml","tier":"tail","description":{"text":"The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.\n","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00957,"percentile":0.61424,"provenance":"source"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"references":[{"url":"https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246p","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021","tags":["x_refsource_MISC"]}],"priority":{"score":17.5,"factors":[{"name":"EPSS percentile","points":12.28},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"crewjam","affectedVersions":[{"vendor":"crewjam","product":"saml","versions":["< 0.4.13"]}],"affected":[{"ecosystem":"Go","package":"github.com/crewjam/saml","vulnerableRanges":["<0.4.13"],"patched":["0.4.13"],"from":["GHSA-5mqj-xc49-246p","GO-2023-1664"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0885","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-crewjam-saml-cve-2020-27846","parents":[{"from":"CVE-2022-41912","to":"CVE-2023-28119","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/crewjam/saml","fromFixed":"0.4.9","toFixed":"0.4.13","daysApart":114},{"kind":"same-code","provenance":"machine","files":["service_provider.go"],"commits":["https://github.com/crewjam/saml/commit/aee3fb1edeeaf1088fcb458727e0fd863d277f8b","https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021"],"basis":"rarely changed file"}]},{"from":"CVE-2020-27846","to":"CVE-2023-28119","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["identity_provider.go","service_provider.go"],"commits":["https://github.com/crewjam/saml/commit/da4f1a0612c0a8dd0452cf8b3c7a6518f6b4d053","https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021"],"basis":"shared function","functions":["NewIdpAuthnRequest","ValidateLogoutResponseRedirect"]}]}],"children":[{"from":"CVE-2023-28119","to":"CVE-2025-30160","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-g8vq-v3mg-7mrg","via":"reference","url":"https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246p"}]}],"packageHistory":[{"cve":"CVE-2020-27846","published":"2020-12-21","fixed":"0.4.3","kev":false},{"cve":"CVE-2022-41912","published":"2022-11-28","fixed":"0.4.9","kev":false},{"cve":"CVE-2023-28119","published":"2023-03-22","fixed":"0.4.13","kev":false},{"cve":"CVE-2023-45683","published":"2023-10-16","fixed":"0.4.14","kev":false,"link":{"from":"CVE-2023-28119","to":"CVE-2023-45683","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/crewjam/saml","fromFixed":"0.4.13","toFixed":"0.4.14","daysApart":208}]}}],"package":"Go:github.com/crewjam/saml"}}