GitHub Advisoryadvisory · PyPI

GHSA-gmhf-gg8w-jw42 SignXML's signature verification with HMAC is vulnerable to a timing attack

MEDIUM Published 2025-06-05 Modified 2025-06-05 Official page ↗
Aliases
CVE-2025-48995
Ecosystem
PyPI
Packages
signxml
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-208
Reviewed
2025-06-05

Affected packages

• PyPI signxml: < 4.0.4 → fixed in 4.0.4

Description

When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), prior versions of SignXML are vulnerable to a potential timing attack. The verifier may leak information about the correct HMAC when comparing it with the user supplied hash, allowing users to reconstruct the correct HMAC for any data.

Related

Alias · CVE (1)

  • CVE-2025-48995 SignXML is an implementation of the W3C XML Signature standard in Python. vulnerability

Weakness · CWE (1)

  • CWE-208 Observable Timing Discrepancy weakness

References