GitHub Advisoryadvisory · Go

GHSA-q547-gmf8-8jr7 github.com/russellhaering/goxmldsig vulnerable to Signature Validation Bypass

MEDIUM Published 2021-05-24 Modified 2023-08-29 Official page ↗
Aliases
CVE-2020-15216
Ecosystem
Go
Packages
github.com/russellhaering/goxmldsig
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-347
Reviewed
2021-05-24

Affected packages

• Go github.com/russellhaering/goxmldsig: < 1.1.0 → fixed in 1.1.0

Description

Impact With a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. Patches A patch is available, all users of goxmldsig should upgrade to v1.1.0. For more information If you have any questions or comments about this advisory open an issue at https://github.com/russellhaering/goxmldsig

Related

Alias · CVE (1)

  • CVE-2020-15216 In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can… vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References