GHSA-2XP3-57P7-QF4V xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing

Summary Default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/sec-CoreValidation. As such, without additional validation steps, the default configuration allows a...

@boxyhq/saml-jackson (>=1.11.2, <=1.17.1), @boxyhq/saml20 (>=1.2.4, <=1.4.1) +7 more potentially affected by CVE-2024-32962 via xml-crypto (>=4.1.0, <=5.1.1)

xml-crypto NPM version =4.1.0, =1.11.2, =1.2.4, =4.0.0, =1.0.0, =0.0.1, =0.0.2 - saml-nofs 3.0.2 - verifactu-utils 1.1.0 Source cves: CVE-2024-32962 Source advisory: OSV:GHSA-2XP3-57P7-QF4V...

xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing

Summary Default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/sec-CoreValidation. As such, without additional validation steps, the default configuration allows a...

Security Bulletin: A security vulnerability in Node.js xml-crypto module affects IBM Cloud Pak for Multicloud Management.

Summary A security vulnerability in Node.js xml-crypto module affects IBM Cloud Pak for Multicloud Management. Vulnerability Details Third Party Entry: 192357 DESCRIPTION: Node.js xml-crypto module security bypass CVSS Base score: 7.5 CVSS Temporal Score: See:...

Improper Key Verification

xml-crypto is vulnerable to improper key verification. An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation...

Validation Bypass

xml-crypto is vulnerable to validation bypass. The vulnerability exists through a possible key confusion by injecting a valid HMAC-SHA1 signature, as both HMAC and the public key digital signature methods key shares the same variable...

xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

Impact An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation. Patches Version 2.0.0 has the fix. Workarounds The recommendation is to upgrade. In case that is not possible remove the...

GHSA-C27R-X354-4M68 xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

Impact An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation. Patches Version 2.0.0 has the fix. Workarounds The recommendation is to upgrade. In case that is not possible remove the...