CVE-2020-15216: Signature Validation Bypass in goxmldsig
Impact With a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one.
Patches A patch is available, all users of goxmldsig should upgrade to v1.1.0.
For more information If you have any questions or comments about this advisory open an issue at https://github.com/russellhaering/goxmldsig
Other sources
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15216?
CVE-2020-15216 has been classified as a high severity vulnerability due to the potential for attackers to bypass signature validation.
How do I fix CVE-2020-15216?
To fix CVE-2020-15216, upgrade goxmldsig to version 1.1.0 or later.
What software is affected by CVE-2020-15216?
CVE-2020-15216 affects the goxmldsig package and certain Fedora versions, specifically 32 and 33.
What is the impact of CVE-2020-15216?
The impact of CVE-2020-15216 allows attackers to bypass signature validation and present altered files as legitimate.
Is there a known patch for CVE-2020-15216?
Yes, a patch is available, and users should upgrade to version 1.1.0 of goxmldsig to mitigate the vulnerability.