CVE-2020-15216: Improper Verification of Cryptographic Signature

May 24, 2021

In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0

References

github.com/advisories/GHSA-q547-gmf8-8jr7
github.com/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb9615e64
github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7
nvd.nist.gov/vuln/detail/CVE-2020-15216
pkg.go.dev/github.com/russellhaering/goxmldsig?tab=overview

Code Behaviors & Features

Detect and mitigate CVE-2020-15216 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →