Description
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
russellhaering goxmldsig
< 1.1.0affected
References
- https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7 ↗
- https://github.com/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb9615e64 ↗
- https://pkg.go.dev/github.com/russellhaering/goxmldsig?tab=overview ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZECBFD4M4PHBMBOCMSQ537NOU37QOVWP/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GUH33FPUXED3FHYL25BJOQPRKFGPOMS2/ ↗