In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/moov-io/signedxml(Go) | 0 | 1.1.0 | N/A |
CVSS Metrics
