packages:
  - module: github.com/russellhaering/goxmldsig
    symbols:
      - ValidationContext.findSignature
    derived_symbols:
      - ValidationContext.Validate
    versions:
      - fixed: 1.1.0
    vulnerable_at: 0.0.0-20200902171629-2e1fbc2c5593
description: |
    An attacker can create an XML file which completely bypasses signature validation,
    passing off an altered file as a signed one.
cves:
  - CVE-2020-15216
ghsas:
  - GHSA-q547-gmf8-8jr7
links:
    commit: https://github.com/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb9615e64
    context:
      - https://github.com/advisories/GHSA-rrfw-hg9m-j47h