CVE-2020-15216
Medium
Description
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0
SeverityMedium
CVSS5.3
Exploit probability60. percentile0.9%
Product
Goxmldsig
PublishedSep 29, 2020
First seenSep 29, 2020
Weakness typeCWE-347CWE-347
How to fix
Update
- goxmldsig_project goxmldsig1.1.0 or later
- github.com/russellhaering/goxmldsig1.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| goxmldsig_project goxmldsig | v < 1.1.0 | 1.1.0 |
| fedoraproject fedora | 32, 33 | — |
| github.com/russellhaering/goxmldsigGo | v < 1.1.0 | 1.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.