Headline
GHSA-jqvr-j2vg-gjrv: Moov signedxml vulnerable to signature wrapping attack
In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).
Moov signedxml vulnerable to signature wrapping attack
Moderate severity GitHub Reviewed Published May 30, 2023 to the GitHub Advisory Database • Updated Jun 6, 2023
Related news
CVE-2023-34205: Critical security vulnerability · Issue #23 · moov-io/signedxml
In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).