CVE-2020-15216 Signature Validation Bypass in goxmldsig

What is CVE-2020-15216?

CVE-2020-15216 is a medium-severity vulnerability in Fedoraproject Fedora, published on 29 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0

Weakness: CWE-347

Which versions are affected by CVE-2020-15216?

3 open source packages ship an affected version, including github.com/russellhaering/goxmldsig. It affects 2 products.

Products include Fedoraproject Fedora, Goxmldsig Project Goxmldsig.

How do I fix CVE-2020-15216?

Upgrade github.com/russellhaering/goxmldsig to 1.1.0 or later.

Is CVE-2020-15216 being exploited?

There is no known exploitation of CVE-2020-15216 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2024-4577 PHP-CGI OS Command Injection Exploited Critical 9.8
• CVE-2021-39226 Grafana Authentication Bypass Exploited Critical 9.8
• CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Exploited Critical 9.8
• CVE-2024-4947 Google Chromium V8 Type Confusion Exploited Critical 9.6
• CVE-2024-4671 Google Chromium Visuals Use-After-Free Exploited Critical 9.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-15216, GHSA-q547-gmf8-8jr7, GO-2020-0050, UBUNTU-CVE-2020-15216.