Executive brief
An attacker can create an XML file which completely bypasses signature validation, passing off an altered file as a signed one.
Affected products
- Go github.com/russellhaering/goxmldsig
Junglewise Threat Intelligence
GO-2022-0409 - An attacker can create an XML file which completely bypasses signature validation, passing off an altered file as a signed one.
Severity: info · Published 2022-07-01
Technologies: github.com/russellhaering/goxmldsig (Go). Vendors: Go.
Related threats
- russellhaering goxmldsig signature bypass in validateSignature
- Critical security issues in XML encoding in github.com/dexidp/dex
- Signature Validation Bypass
- GO-2020-0046 - Panic due to malformed XML digital signature in github.com/russellhaering/goxmldsig
- GO-2020-0050 - XML digital signature validation bypass in github.com/russellhaering/goxmldsig