CVE-2020-29511: 
Go vulnerability analysis and mitigation

The encoding/xml package in Go (all versions) contains a vulnerability (CVE-2020-29511) where it fails to correctly preserve the semantics of element namespace prefixes during tokenization round-trips. This vulnerability was discovered and reported by Mattermost, Inc. in December 2020 (NIST NVD, Mattermost Advisory).

The vulnerability allows attackers to craft XML inputs that behave inconsistently during different stages of processing in affected downstream applications. The issue specifically affects how namespace prefixes on XML elements are handled during xml.Decoder and xml.Encoder implementations. The vulnerability has received a CVSS v3.1 base score of 5.6 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L, though initially it was rated higher at 9.8 (Critical) (NIST NVD).

The vulnerability can cause mutations during encoding round-trips, leading to incorrect or conflicting decisions in affected applications. For example, in SAML implementations, this could allow an attacker to have a SAML Assertion interpreted as signed while reading values from an unsigned part of the same document, potentially leading to authentication bypass and privilege escalation within the SAML Service Provider scope (Mattermost Advisory).

The vulnerability requires network access and high attack complexity. Equivalent lookups within an XML document can return different results during different stages of the document's lifecycle, and validation of XML document structure can succeed or fail depending on the number of encoding round-trips it has undergone (Mattermost Advisory).

A workaround has been provided through the github.com/mattermost/xml-roundtrip-validator module, which can detect unstable constructs in XML documents, including unstable element namespace prefixes. It is recommended to invoke the validator on all untrusted markup and fail early if it returns an error (Mattermost Advisory).

The vulnerability has been acknowledged by multiple organizations and vendors. NetApp has issued an advisory (NTAP-20210129-0006) addressing this vulnerability in their products. Notably, upstream Go developers have indicated they likely won't fix this issue, shifting responsibility to SAML packages (Ubuntu Security).