x/vulndb: potential Go vuln in github.com/tyktechnologies/tyk-identity-broker: GHSA-599h-8wpj-75xj

[GoVulnBot]

In GitHub Security Advisory GHSA-599h-8wpj-75xj, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/tyktechnologies/tyk-identity-broker	1.1.1	< 1.1.1

Cross references:

• CVE-2021-23365 appears in issue x/vulndb: potential Go vuln in github.com/tyktechnologies/tyk-identity-broker: CVE-2021-23365, GHSA-599h-8wpj-75xj #906 NOT_IMPORTABLE
• GHSA-599h-8wpj-75xj appears in issue x/vulndb: potential Go vuln in github.com/tyktechnologies/tyk-identity-broker: CVE-2021-23365, GHSA-599h-8wpj-75xj #906 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: TODO
    versions:
      - fixed: 1.1.1
    packages:
      - package: github.com/tyktechnologies/tyk-identity-broker
description: The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1
    are vulnerable to Authentication Bypass via the Go XML parser which can cause
    SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity
    in the XML round-trip (encoding/decoding XML data).
cves:
  - CVE-2021-23365
ghsas:
  - GHSA-599h-8wpj-75xj

[tatianab]

Duplicate of #906