CVE catalog

CVE-2020-15216

golang-github-russellhaering-goxmldsig: CVE-2020-15216

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.90% · Oct 25, 2026

In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-russellhaering-goxmldsigbookworm1.2.0-1fixed
Ubuntugolang-github-russellhaering-goxmldsig18.040.0~git20170911.b7efc62-1vulnerable
Ubuntugolang-github-russellhaering-goxmldsig20.040.0~git20170911.b7efc62-1vulnerable
Ubuntugolang-github-russellhaering-goxmldsig20.040.0~git20180430.7acd5e4-1vulnerable
Ubuntugolang-github-russellhaering-goxmldsig22.041.1.0-1vulnerable
Ubuntugolang-github-russellhaering-goxmldsig22.041.1.1-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-russellhaering-goxmldsigsourcebookworm1.1.0-1not yet assignedNot reported[971615]

[Debian bug #971615]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-russellhaering-goxmldsig-dev]Fixed

    Source package: [golang-github-russellhaering-goxmldsig]

    Details (2)

    • 1.2.0-1 · all · bookworm

      Fixed · Fixed: 1.1.0-1

      dsa · golang-github-russellhaering-goxmldsig · debian · bookworm; dsa · golang-github-russellhaering-goxmldsig · debian · 12

    • 1.2.0-1 · all · bookworm

      Fixed · Fixed: 1.1.0-1

      dsa · golang-github-russellhaering-goxmldsig · debian · bookworm; dsa · golang-github-russellhaering-goxmldsig · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]