p PatchFirst

CVE-2025-29775

CVE-2025-29775 · xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively.

CVSS 9.3 · Critique · EPSS 10,1% · Correctif disponible

Publication
Mise à jour

Pile logicielle: node

Produits et versions concernés

  • xml-crypto

    Versions du logiciel
    • >= 4.0.0, < 6.0.1: Concernée
    • >= 3.0.0, < 3.2.1: Concernée
    • < 2.1.6: Concernée

    Aucun correctif publié

  • xml-crypto npm

    Plages de versions concernées
    • SEMVER: ≥ 4.0.0, < 6.0.1

    Mettez à jour vers 6.0.1

  • xml-crypto npm

    Plages de versions concernées
    • SEMVER: ≥ 3.0.0, < 3.2.1

    Mettez à jour vers 3.2.1

  • xml-crypto npm

    Plages de versions concernées
    • SEMVER: < 2.1.6

    Mettez à jour vers 2.1.6

Sources originales

Vérifiez votre serveur →