github.com/moov-io/signedxml
pure go library for processing signed XML documents
View on Github
Activity
- Latest release
- 2w ago
- Total releases
- 13
- Cadence
- ~2 months
- Last 12 months
- 6
Reach
- Stars
- 66
Details
- First release
- Apr 21, 2023
| Version | Released | |
|---|---|---|
v1.4.1
patch
|
v1.4.1
patch
Dependencies (6)
|
|
v1.4.0
minor
|
v1.4.0
minor
Dependencies (6)
|
|
v1.3.1
patch
|
v1.3.1
patch
Dependencies (5)
|
|
v1.3.0
minor
|
v1.3.0
minor
Dependencies (5)
|
|
v1.2.5
patch
|
v1.2.5
patch
Dependencies (4)
|
|
v1.2.4
patch
|
v1.2.4
patch
Dependencies (4)
|
|
v1.2.3
patch
|
v1.2.3
patch
Dependencies (4)
|
|
v1.2.2
patch
|
v1.2.2
patch
Dependencies (4)
|
|
v1.2.1
patch
|
v1.2.1
patch
Dependencies (3)
|
|
v1.2.0
minor
|
v1.2.0
minor
Dependencies (3)
|
|
v1.1.1
patch
|
v1.1.1
patch
Dependencies (3)
|
|
v1.1.0
minor
|
v1.1.0
minor
Dependencies (3)
|
|
v1.0.0
initial
1 CVE
CVE-2023-34205
GO-2023-1826
GHSA-jqvr-j2vg-gjrv
Jun 09, 2023
Signature validation bypass in github.com/moov-io/signedxml Signature validation canonicalizes the input XML document before validating the signature. Parsing the uncanonicalized and canonicalized forms can produce different results. An attacker can exploit this variation to bypass signature validation. Users of signature validation must only parse the canonicalized form of the validated document. The Validator.Validate function does not return the canonical form, and cannot be used safely. Users should only use the Validator.ValidateReferences function and only parse the canonical form which it returns. The Validator.Validate function was removed in github.com/moov-io/signedxml v1.1.0. Fixed in
1.1.0
Updated May 20, 2024 · Source: OSV.dev |
v1.0.0
initial
Dependencies (3)
|