GitHub Advisoryadvisory · Go

GHSA-jqvr-j2vg-gjrv Signature validation bypass in github.com/moov-io/signedxml

CRITICAL Published 2023-05-30 Modified 2025-01-13 Official page ↗
Aliases
CVE-2023-34205
Ecosystem
Go
Packages
github.com/moov-io/signedxml
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-347
Reviewed
2023-06-06

Affected packages

• Go github.com/moov-io/signedxml: < 1.1.0 → fixed in 1.1.0

Description

In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).

Related

Alias · CVE (1)

  • CVE-2023-34205 In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References