critical9.1
CVE-2023-34205
Signature validation bypass in github.com/moov-io/signedxml
Impact
In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/moov-io/signedxml | < 1.1.0 | 1.1.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moov | Signedxml | Version 1.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/moov-io/signedxml/issues/23
- https://github.com/advisories/GHSA-jqvr-j2vg-gjrv
- https://nvd.nist.gov/vuln/detail/CVE-2023-34205
- https://github.com/moov-io/signedxml/pull/25
- https://github.com/moov-io/signedxml/releases/tag/v1.1.0
- https://pkg.go.dev/vuln/GO-2023-1826