CVE-2020-26276: 
NixOS vulnerability analysis and mitigation

CVE-2020-26276 affects Fleet, an open source osquery manager, in versions before 3.5.1. The vulnerability was discovered in December 2020 and relates to issues in Go's standard library XML parsing, where a valid SAML response may be mutated by an attacker to modify the trusted document (Fleet Advisory).

The vulnerability stems from issues in Go's encoding/xml library where maliciously crafted XML markup can mutate during round-trips through Go's decoder and encoder implementations. This means that passing XML through Go's decoder and encoder doesn't preserve its semantics, which is particularly critical for SAML authentication. The vulnerability has a CVSS v3.1 base score of 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

The vulnerability can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. An attacker could potentially bypass authentication mechanisms and gain unauthorized access to the system (Fleet Advisory).

The vulnerability requires an attacker to craft a specific SAML response that exploits the XML parsing issues. The attack can be executed remotely without requiring any privileges or user interaction (Mattermost Blog).

The issue was patched in Fleet version 3.5.1 using the xml-roundtrip-validator from Mattermost. If upgrading to version 3.5.1 is not possible, users should disable SSO authentication in Fleet as a workaround (Fleet Advisory).

The vulnerability was part of a coordinated disclosure effort involving multiple affected parties. The Go security team worked on addressing these vulnerabilities but determined that some of the root causes could not be reliably addressed in the standard library. This led to the development of new APIs and mitigation strategies (Mattermost Blog).