CVE catalog
CVE-2022-41912
UBUNTU-CVE-2022-41912
- Severity
- Critical · CVSS 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 2.33% · Oct 25, 2026
The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | golang-github-crewjam-saml | 22.04 | 0.4.5+git20201228.07f15a6-2 | vulnerable |
| Ubuntu | golang-github-crewjam-saml | 22.04 | 0.4.6-1 | vulnerable |
| Ubuntu | golang-github-crewjam-saml | 22.04 | 0.4.6-2 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: