| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/russellhaering/goxmldsig | < 1.1.0 | 1.1.0 |
| goxmldsig | < 1.1.0 | 1.1.0 |
With a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one.
A patch is available, all users of goxmldsig should upgrade to v1.1.0.
If you have any questions or comments about this advisory open an issue at https://github.com/russellhaering/goxmldsig
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free