PT-2025-23537 · Signxml · Signxml

Ahacker1-Securesaml · Published 2025-06-02 · Updated 2025-06-05 · CVE-2025-48994

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SignXML versions prior to 4.0.4

Description The issue concerns a potential algorithm confusion attack when verifying signatures with X509 certificate validation turned off and HMAC shared secret set. This could allow an attacker to supply a signature unexpectedly signed with a key other than the provided HMAC key, using a different signature algorithm, unless the user explicitly limits the expected signature algorithms.

Recommendations For versions prior to 4.0.4, consider explicitly limiting the expected signature algorithms using the signxml.XMLVerifier.verify(expect config=...) setting to prevent algorithm confusion attacks. As a temporary workaround, consider restricting the set of accepted signature algorithms to HMAC only, if possible, until a patch is available. Update to SignXML version 4.0.4 or later, as it restricts the set of accepted signature algorithms to HMAC only when hmac key is specified.

Exploit

Fix

Weakness Enumeration

CWE-303

Related Identifiers

CVE-2025-48994

GHSA-6VX8-PCWV-XHF4

Affected Products

Signxml

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48994.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-48994 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-48994 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6vx8-pcwv-xhf4 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-48994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48994 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48994 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-48994 · Security Note
• https://ubuntu.com/security/CVE-2025-48994 · Vendor Advisory
• https://github.com/XML-Security/signxml/security/advisories/GHSA-6vx8-pcwv-xhf4 · Note
• https://github.com/XML-Security/signxml/commit/e3c0c2b82a3329a65d917830657649c98b8c7600 · Note
• https://github.com/XML-Security/signxml · Note
• https://t.me/cvetracker/25201 · Telegram Post
• https://twitter.com/CVEnew/status/1929581583855452371 · Twitter Post