blob: fd20baa73ead16b36bcff96f35541ad0b25d942f [file] [log] [blame]
id: GO-2023-1826
modules:
- module: github.com/moov-io/signedxml
versions:
- fixed: 1.1.0
vulnerable_at: 1.0.0
packages:
- package: github.com/moov-io/signedxml
symbols:
- Validator.Validate
summary: Signature validation bypass in github.com/moov-io/signedxml
description: |-
Signature validation canonicalizes the input XML document before validating the
signature. Parsing the uncanonicalized and canonicalized forms can produce
different results. An attacker can exploit this variation to bypass signature
validation.
Users of signature validation must only parse the canonicalized form of the
validated document. The Validator.Validate function does not return the
canonical form, and cannot be used safely. Users should only use the
Validator.ValidateReferences function and only parse the canonical form which it
returns.
The Validator.Validate function was removed in github.com/moov-io/signedxml
v1.1.0.
cves:
- CVE-2023-34205
ghsas:
- GHSA-jqvr-j2vg-gjrv
references:
- report: https://github.com/moov-io/signedxml/issues/23
review_status: REVIEWED