openleadr (0.5.30), pyopenadr (0.5.30) potentially affected by CVE-2025-48995 via signxml (3.1.1)

signxml PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - openleadr 0.5.30 - pyopenadr 0.5.30 Source cves: CVE-2025-48995 Source advisory: OSV:GHSA-GMHF-GG8W-JW42...

pytrustnfe3 (>=0.1.0, <=0.9.4) potentially affected by CVE-2025-48995 via signxml (2.5.2)

signxml PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - pytrustnfe3 =0.1.0, =0.9.4 Source cves: CVE-2025-48995 Source advisory: OSV:GHSA-GMHF-GG8W-JW42...

CVE-2025-48994

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2025-48995

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

Timing Attack

Overview signxml is a Python XML Signature and XAdES library Affected versions of this package are vulnerable to Timing Attack due to the verify function in XMLVerifier. An attacker can infer the correct HMAC used for XML signature verification by observing the time it takes to compare the comput...

alertwise (1.0.0) potentially affected by CVE-2025-48995 via signxml (4.0.2)

signxml PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - alertwise 1.0.0 Source cves: CVE-2025-48995 Source advisory: SNYK:PYTHON-SIGNXML-10303872...

CVE-2025-48995

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

DEBIAN-CVE-2025-48995

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2025-48994

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

DEBIAN-CVE-2025-48994

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

UBUNTU-CVE-2025-48994

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

UBUNTU-CVE-2025-48995

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

Incorrect Implementation of Authentication Algorithm

Overview signxml is a Python XML Signature and XAdES library Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to the improper handling of signature verification settings when requirex509 is set to false and hmackey is specified. An...

alertwise (1.0.0) potentially affected by CVE-2025-48994 via signxml (4.0.2)

signxml PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - alertwise 1.0.0 Source cves: CVE-2025-48994 Source advisory: SNYK:PYTHON-SIGNXML-10303863...

CVE-2025-48995

CVE-2025-48995 affects SignXML (Python implementation of W3C XML Signature) prior to 4.0.4. When verify() is called with require_x509=False and an HMAC secret (hmac_key=...), the timing-based vulnerability may leak information about the correct HMAC during the comparison, enabling reconstruction ...

CVE-2025-48995 SignXML's signature verification with HMAC is vulnerable to a timing attack

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2025-48995

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set "signxml.XMLVerifier.verifyrequirex509=False, hmackey=...", versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2025-48995 SignXML's signature verification with HMAC is vulnerable to a timing attack

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2025-48995 SignXML's signature verification with HMAC is vulnerable to a timing attack

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

alertwise (1.0.0), aos-signer (>=0.0.6, <=1.8.0) +19 more potentially affected by CVE-2025-48995 via signxml (>=2.5.2, <=4.0.2)

signxml PYPI version =2.5.2, =0.0.6, =0.5.1, =1.0.0, =0.5.1, =1.0.0, =0.1.0, =0.1.0, =1.1.0, =0.1.0, =1.4.0, =2.0.0, =1.0.0, =0.5.3, =0.5.30 - pynfe 0.4.3 and more Source cves: CVE-2025-48995 Source advisory: MEND:CVE-2025-48995...