CVE-2020-15216
Fixed in a distro release EPSS <1%CVSS 5.3
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0
Products: russellhaering goxmldsig
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/russellhaering/goxmldsig | 1.1.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | golang-github-russellhaering-goxmldsig | 1.1.0-1 |
| Ubuntu 18.04 LTS | golang-github-russellhaering-goxmldsig | no fix |
| Ubuntu 20.04 LTS | golang-github-russellhaering-goxmldsig | no fix |
| Ubuntu 22.04 LTS | golang-github-russellhaering-goxmldsig | no fix |