icon

We found results for “

CVE-2025-48994

Good to know:

icon

Date: June 2, 2025

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set ("signxml.XMLVerifier.verify(require_x509=False, hmac_key=..."), versions of SignXML prior to 4.0.4 are vulnerable to a potential algorithm confusion attack. Unless the user explicitly limits the expected signature algorithms using the "signxml.XMLVerifier.verify(expect_config=...)" setting, an attacker may supply a signature unexpectedly signed with a key other than the provided HMAC key, using a different (asymmetric key) signature algorithm. Starting with SignXML 4.0.4, specifying "hmac_key" causes the set of accepted signature algorithms to be restricted to HMAC only, if not already restricted by the user.

Severity Score

Severity Score

Weakness Type (CWE)

Incorrect Implementation of Authentication Algorithm

CWE-303

Top Fix

icon

Upgrade Version

Upgrade to version signxml - 4.0.4;https://github.com/XML-Security/signxml.git - v4.0.4

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us