Vulnerability GHSA-jqvr-j2vg-gjrv
Critical
CRITICAL RISK
CVSS Score: 9.1
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
3 years ago
May 30, 2023 at 06:30 AM UTC
Signature validation bypass in github.com/moov-io/signedxml
v1.0.0
v1.0.0
Summary
Signature validation bypass in github.com/moov-io/signedxml
Details
In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
3 hours ago
Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization
v1.0.0 - v1.4.0 GHSA-5588-rp99-5fjh
v1.0.0 - v1.4.0 GHSA-5588-rp99-5fjh
Unknown
3 years ago
Signature validation bypass in github.com/moov-io/signedxml
v1.0.0 GO-2023-1826
v1.0.0 GO-2023-1826
Impacted packages
Timeline
Published
3 years ago
May 30, 2023 at 06:30 AM UTC
Fixed (v1.1.0)
3 years ago
May 30, 2023 at 07:13 PM UTC
Last Modified
1 year ago
January 13, 2025 at 03:41 PM UTC