5.3
Medium
CVE-2020-15216 In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an…
Description
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| goxmldsig 1.1 | earliest → < 1.1.0 | 1.1.0 |
References
- github.com github.com
- github.com github.com
- pkg.go.dev pkg.go.dev
- FEDORA-2021-a2a7673da2 lists.fedoraproject.org
- FEDORA-2021-9316ee2948 lists.fedoraproject.org
Timeline
- Published
- Last modified