CVE-2020-15216

Katalog CVE

CVSS 6.5 · Medium EPSS 0,90%

Kerentanan Improper Verification of Cryptographic Signature pada goxmldsig project goxmldsig, fedoraproject fedora. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0

Rincian

Terbit di NVD

29 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,90% peluang dieksploitasi; lebih tinggi dari 58,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb9615e64 patch · advisory pihak ketiga
• https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7 advisory pihak ketiga
• https://pkg.go.dev/github.com/russellhaering/goxmldsig?tab=overview advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GUH33FPUXED3F...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZECBFD4M4PHBM...