alertwise (1.0.0), aos-signer (>=0.0.6, <=1.8.0) +19 more potentially affected by CVE-2025-48995 via signxml (>=2.5.2, <=4.0.2)

signxml PYPI version =2.5.2, =0.0.6, =0.5.1, =1.0.0, =0.5.1, =1.0.0, =0.1.0, =0.1.0, =1.1.0, =0.1.0, =1.4.0, =2.0.0, =1.0.0, =0.5.3, =0.5.30 - pynfe 0.4.3 and more Source cves: CVE-2025-48995 Source advisory: MEND:CVE-2025-48995...

CVE-2025-48994 SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2025-48994 SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2025-48994

SignXML (Python) prior to 4.0.4 is vulnerable to an algorithm confusion attack when verifying signatures with require_x509=False and hmac_key is set, allowing an attacker to forge a signature under a different algorithm if the expected signature algorithms are not restricted (verify(expect_config...

CVE-2025-48994

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set "signxml.XMLVerifier.verifyrequirex509=False, hmackey=...", versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2025-48994 SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2025-48994

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

alertwise (1.0.0), aos-signer (>=0.0.6, <=1.8.0) +19 more potentially affected by CVE-2025-48994 via signxml (>=2.5.2, <=4.0.2)

signxml PYPI version =2.5.2, =0.0.6, =0.5.1, =1.0.0, =0.5.1, =1.0.0, =0.1.0, =0.1.0, =1.1.0, =0.1.0, =1.4.0, =2.0.0, =1.0.0, =0.5.3, =0.5.30 - pynfe 0.4.3 and more Source cves: CVE-2025-48994 Source advisory: MEND:CVE-2025-48994...

SignXML security vulnerability

SignXML is an open source XML signing and XAdES library for Python from XML-Security. A security vulnerability exists in SignXML versions prior to 4.0.4, which stems from a timing attack flaw that could lead to HMAC key disclosure...

PT-2025-23537

Name of the Vulnerable Software and Affected Versions SignXML versions prior to 4.0.4 Description The issue concerns a potential algorithm confusion attack when verifying signatures with X509 certificate validation turned off and HMAC shared secret set. This could allow an attacker to supply a...

PT-2025-23540

Name of the Vulnerable Software and Affected Versions SignXML versions prior to 4.0.4 Description The issue concerns a potential timing attack when verifying signatures with X509 certificate validation turned off and HMAC shared secret set. This could allow users to reconstruct the correct HMAC f...

SignXML security vulnerability

SignXML is an open source XML signing and XAdES library for Python from XML-Security. A security vulnerability exists in SignXML versions prior to 4.0.4, which stems from an algorithm obfuscation flaw that could lead to the use of unintended keys to verify signatures...

CVE-2025-48994: Incorrect Implementation of Authentication Algorithm

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2025-48995: Observable Timing Discrepancy

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

atlassian-jwt-auth (>=2.0.0, <=2.1.0), pyjwe (0.1.4) +3 more potentially affected by CVE-2023-50782 via cryptography (1.0.2)

cryptography PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.0.0, =1.0.1, =0.4.5, =0.5.0, =0.5.1 Source cves: CVE-2023-50782 Source advisory: OSV:GHSA-3WW4-GG4F-JR7F...

atlassian-jwt-auth (>=2.10.1, <=3.0.1), mitmproxy (>=2.0.1, <=2.0.2) +10 more potentially affected by CVE-2023-50782 via cryptography (1.8.2)

cryptography PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.10.1, =2.0.1, =0.1.2, =0.4.0, =0.0.1, =1.3.6, =2.4.6, =1.1.1, =1.4.0, =1.5.0 Source cves: CVE-2023-50782 Source...

signxml (>=0.4.2, <=0.4.4) potentially affected by CVE-2023-50782 via cryptography (0.9.3)

cryptography PYPI version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - signxml =0.4.2, =0.4.4 Source cves: CVE-2023-50782 Source advisory: OSV:GHSA-3WW4-GG4F-JR7F...

atlassian-jwt-auth (>=2.0.0, <=2.1.0), pyjwe (0.1.4) +3 more potentially affected by CVE-2024-0727 via cryptography (1.0.2)

cryptography PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.0.0, =1.0.1, =0.4.5, =0.5.0, =0.5.1 Source cves: CVE-2024-0727 Source advisory: OSV:GHSA-9V9H-CGJ8-H64P...

signxml (>=0.4.2, <=0.4.4) potentially affected by CVE-2024-0727 via cryptography (0.9.3)

cryptography PYPI version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - signxml =0.4.2, =0.4.4 Source cves: CVE-2024-0727 Source advisory: OSV:GHSA-9V9H-CGJ8-H64P...

atlassian-jwt-auth (2.5.0), netlib (0.16.0) +1 more potentially affected by CVE-2024-0727 via cryptography (1.2.3)

cryptography PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.5.0 - netlib 0.16.0 - signxml =0.5.0, =1.0.0 Source cves: CVE-2024-0727 Source advisory: OSV:GHSA-9V9H-CGJ8-H64P...