CVE-2020-27847: 
NixOS vulnerability analysis and mitigation

A critical vulnerability (CVE-2020-27847) was discovered in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This vulnerability allows attackers to bypass SAML authentication, affecting versions up to and including 2.26.0 (Dex Advisory, Mattermost Blog).

The vulnerability stems from issues in Go's encoding/xml library where maliciously crafted XML markup mutates during round-trips through Go's decoder and encoder implementations. This affects the semantic integrity of XML processing, which is crucial for SAML authentication. The flaw specifically impacts the SAML connector's signature validation process, potentially allowing manipulation of SAML messages while maintaining the appearance of valid signatures (Mattermost Blog).

The vulnerability enables attackers to bypass SAML authentication completely. In SAML SSO implementations, this could lead to arbitrary privilege escalation within the scope of the SAML Service Provider or complete authentication bypass, as attackers could alter SAML messages to impersonate different identities while maintaining valid signatures (Mattermost Blog).

The vulnerability was considered critical due to its potential for authentication bypass. It affected all versions of dexidp/dex up to and including version 2.26.0, and was particularly concerning for systems using SAML-based authentication (Dex Advisory).

The vulnerability was patched in Dex version 2.27.0. Users are strongly advised to update to this version immediately. No alternative workarounds were provided for earlier versions (Dex Advisory, Red Hat Bugzilla).

Red Hat acknowledged the vulnerability but downgraded its severity for Red Hat Advanced Cluster Management for Kubernetes 2.1, noting that the affected library is only used in testing and not accessible in production environments. They committed to removing this dependency in future updates (Red Hat Bugzilla).