What’s Vulnerable › Vulnerabilities
CVE-2020-27846
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 4.9% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-12-21 · updated 2026-06-17
- Weakness: CWE-115
Description
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Affected products
- Fedoraproject Fedora: 32, 33
- Grafana: before 6.7.5; from 7.0.0 before 7.2.3; from 7.3.0 before 7.3.6 — fixed in 6.7.5, 7.2.3, 7.3.6
- Red Hat Enterprise Linux: 8.0
- Red Hat OpenShift Container Platform 4.18: 3.11, 4.0
- Red Hat OpenShift Service Mesh 2: 2.0
- crewjam saml: before 0.4.3 — fixed in 0.4.3
How to fix
Upgrade to a fixed version: Grafana 6.7.5, 7.2.3, 7.3.6; crewjam saml 0.4.3. Check the vendor advisory for mitigations.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1907670
- https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9
- https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
- https://security.netapp.com/advisory/ntap-20210205-0002/
- https://bugzilla.redhat.com/show_bug.cgi?id=1907670
- https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9
- https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/
Get alerted when CVE-2020-27846 or the next vulnerability affects your stack