GHSA-c27r-x354-4m68

GHSA-c27r-x354-4m68 · xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

This page contains facts from public vulnerability sources. Check the original advisory before updating.

### Impact An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation. ### Patches Version 2.0.0 has the fix. ### Workarounds The recommendation is to upgrade. In case that is not possible remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from SignedXml.SignatureAlgorithms.

Fix available

Published

2020-10-27T20:39:46Z

Updated

2022-08-02T20:03:05Z

Stack: node

Check your server →