data/reports/GO-2023-1826.yaml

id: GO-2023-1826
modules:
    - module: github.com/moov-io/signedxml
      versions:
        - fixed: 1.1.0
      vulnerable_at: 1.0.0
      packages:
        - package: github.com/moov-io/signedxml
          symbols:
            - Validator.Validate
summary: Signature validation bypass in github.com/moov-io/signedxml
description: |-
    Signature validation canonicalizes the input XML document before validating the
    signature. Parsing the uncanonicalized and canonicalized forms can produce
    different results. An attacker can exploit this variation to bypass signature
    validation.

    Users of signature validation must only parse the canonicalized form of the
    validated document. The Validator.Validate function does not return the
    canonical form, and cannot be used safely. Users should only use the
    Validator.ValidateReferences function and only parse the canonical form which it
    returns.

    The Validator.Validate function was removed in github.com/moov-io/signedxml
    v1.1.0.
cves:
    - CVE-2023-34205
ghsas:
    - GHSA-jqvr-j2vg-gjrv
references:
    - report: https://github.com/moov-io/signedxml/issues/23
review_status: REVIEWED