Log in Start free

Vulnerability · Published Sep 29, 2020 · Assigned by GitHub_M

CVE-2020-15216Signature Validation Bypass in goxmldsig

Medium 5.3

In plain English

A medium-severity security flaw in goxmldsig from russellhaering. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.9%top 40.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-github-russellhaering-goxmldsig1.1.0-1DEBIAN-CVE-2020-15216
Gogithub.com/russellhaering/goxmldsig1.1.0GHSA-q547-gmf8-8jr7
Gogithub.com/russellhaering/goxmldsig1.1.0GO-2020-0050
Ubuntu:22.04:LTSgolang-github-russellhaering-goxmldsigno fix listedUBUNTU-CVE-2020-15216

Affected products (as reported)

VendorProductVersions
russellhaering goxmldsig < 1.1.0

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

References