nv-attestation-sdk (>=1.4.0, <=2.7.3), nv-local-gpu-verifier (>=2.0.0, <=2.7.3) +1 more potentially affected by CVE-2025-48994 via signxml (3.2.0)

signxml PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - nv-attestation-sdk =1.4.0, =2.0.0, =1.0.0, =1.7.3 Source cves: CVE-2025-48994 Source advisory: OSV:GHSA-6VX8-PCWV-XHF4...

openleadr (0.5.30), pyopenadr (0.5.30) potentially affected by CVE-2025-48994 via signxml (3.1.1)

signxml PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - openleadr 0.5.30 - pyopenadr 0.5.30 Source cves: CVE-2025-48994 Source advisory: OSV:GHSA-6VX8-PCWV-XHF4...

ksef-utils (>=1.1.0, <=1.4.0), pytbai (>=1.5.3, <=1.6.3) +1 more potentially affected by CVE-2025-48994 via signxml (3.2.1)

signxml PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - ksef-utils =1.1.0, =1.5.3, =0.9.17, =1.0.61 Source cves: CVE-2025-48994 Source advisory: OSV:GHSA-6VX8-PCWV-XHF4...

aos-signer (>=1.6.1, <=1.8.0), cl-sii (>=0.11.1, <=0.26.0) +10 more potentially affected by CVE-2025-48994 via signxml (3.2.2)

signxml PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - aos-signer =1.6.1, =0.11.1, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.7.0, =0.9.6, =8.0.2, =9.1.2 Source cves: CVE-2025-48994 Source advisory:...

alertwise (1.0.0) potentially affected by CVE-2025-48994 via signxml (4.0.2)

signxml PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - alertwise 1.0.0 Source cves: CVE-2025-48994 Source advisory: OSV:GHSA-6VX8-PCWV-XHF4...

GHSA-6VX8-PCWV-XHF4 SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack

When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., prior versions of SignXML are vulnerable to a potential algorithm confusion attack. Unless the user explicitly limits the expected signature...

alertwise (1.0.0) potentially affected by CVE-2025-48994 via signxml (4.0.2)

signxml PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - alertwise 1.0.0 Source cves: CVE-2025-48994 Source advisory: GHSA-6VX8-PCWV-XHF4...

GHSA-GMHF-GG8W-JW42 SignXML's signature verification with HMAC is vulnerable to a timing attack

When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., prior versions of SignXML are vulnerable to a potential timing attack. The verifier may leak information about the correct HMAC when comparing...

SignXML's signature verification with HMAC is vulnerable to a timing attack

When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., prior versions of SignXML are vulnerable to a potential timing attack. The verifier may leak information about the correct HMAC when comparing...

alertwise (1.0.0) potentially affected by CVE-2025-48995 via signxml (4.0.2)

signxml PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - alertwise 1.0.0 Source cves: CVE-2025-48995 Source advisory: GHSA-GMHF-GG8W-JW42...

aos-signer (>=1.6.1, <=1.8.0), cl-sii (>=0.11.1, <=0.26.0) +10 more potentially affected by CVE-2025-48995 via signxml (3.2.2)

signxml PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - aos-signer =1.6.1, =0.11.1, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.7.0, =0.9.6, =8.0.2, =9.1.2 Source cves: CVE-2025-48995 Source advisory:...

erpbrasil-assinatura (1.4.0) potentially affected by CVE-2025-48995 via signxml (2.8.2)

signxml PYPI version 2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - erpbrasil-assinatura 1.4.0 Source cves: CVE-2025-48995 Source advisory: OSV:GHSA-GMHF-GG8W-JW42...

ksef-utils (>=1.1.0, <=1.4.0), pytbai (>=1.5.3, <=1.6.3) +1 more potentially affected by CVE-2025-48995 via signxml (3.2.1)

signxml PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - ksef-utils =1.1.0, =1.5.3, =0.9.17, =1.0.61 Source cves: CVE-2025-48995 Source advisory: OSV:GHSA-GMHF-GG8W-JW42...

cl-sii (>=0.5.1, <=0.11.0), md-sign (>=0.1.0, <=0.1.1) +4 more potentially affected by CVE-2025-48995 via signxml (2.10.1)

signxml PYPI version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - cl-sii =0.5.1, =0.1.0, =0.5.3, =0.5.27, =5.0.0, =5.1.1 Source cves: CVE-2025-48995 Source advisory: OSV:GHSA-GMHF-GG8W-JW42...

alertwise (1.0.0) potentially affected by CVE-2025-48995 via signxml (4.0.2)

signxml PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - alertwise 1.0.0 Source cves: CVE-2025-48995 Source advisory: OSV:GHSA-GMHF-GG8W-JW42...

nv-attestation-sdk (>=1.4.0, <=2.7.3), nv-local-gpu-verifier (>=2.0.0, <=2.7.3) +1 more potentially affected by CVE-2025-48995 via signxml (3.2.0)

signxml PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - nv-attestation-sdk =1.4.0, =2.0.0, =1.0.0, =1.7.3 Source cves: CVE-2025-48995 Source advisory: OSV:GHSA-GMHF-GG8W-JW42...

erpbrasil-assinatura (>=0.5.1, <=0.5.2) potentially affected by CVE-2025-48995 via signxml (2.8.0)

signxml PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - erpbrasil-assinatura =0.5.1, =0.5.2 Source cves: CVE-2025-48995 Source advisory: OSV:GHSA-GMHF-GG8W-JW42...

erpbrasil-assinatura (>=1.0.2, <=1.2.0) potentially affected by CVE-2025-48995 via signxml (2.8.1)

signxml PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - erpbrasil-assinatura =1.0.2, =1.2.0 Source cves: CVE-2025-48995 Source advisory: OSV:GHSA-GMHF-GG8W-JW42...

aos-signer (>=0.0.6, <=0.4.0) potentially affected by CVE-2025-48995 via signxml (2.7.2)

signxml PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - aos-signer =0.0.6, =0.4.0 Source cves: CVE-2025-48995 Source advisory: OSV:GHSA-GMHF-GG8W-JW42...

pynfse (0.2.0) potentially affected by CVE-2025-48995 via signxml (2.6.0)

signxml PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - pynfse 0.2.0 Source cves: CVE-2025-48995 Source advisory: OSV:GHSA-GMHF-GG8W-JW42...