CVE-2023-34205: Critical severity Moov Signedxml Go vulnerability
In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/moov-io/signedxmlto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-34205?
CVE-2023-34205 is of moderate severity due to the potential for bypassing signature validation through a Signature Wrapping attack.
How do I fix CVE-2023-34205?
To fix CVE-2023-34205, upgrade Moov signedxml to version 1.1.0 or later.
What does CVE-2023-34205 affect?
CVE-2023-34205 affects Moov signedxml version 1.0.0 for Go applications.
What kind of attacks can CVE-2023-34205 lead to?
CVE-2023-34205 can lead to Signature Wrapping attacks, enabling unauthorized actions via bypassed signature validation.
Is CVE-2023-34205 still a concern if I am using a version after 1.1.0?
No, if you are using a version later than 1.1.0, CVE-2023-34205 should not be a concern as it has been addressed in those versions.