Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

GHSA-c27r-x354-4m68

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-c27r-x354-4m68

xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion ### Impact An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation. ### Patches Version 2.0.0 has the fix. ### Workarounds The recommendation is to upgrade. In case that is not possible remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from SignedXml.SignatureAlgorithms.

gitlab/npm/xml-crypto/GMS-2020-561

HMAC-SHA1 signatures can bypass validation via key confusion ### Impact An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation. ### Patches has the fix. ### Workarounds The recommendation is to upgrade. In case that is not possible remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from SignedXml.SignatureAlgorithms.