PT-2025-23540 · Signxml · Signxml

Ahacker1-Securesaml · Published 2025-06-02 · Updated 2025-06-05 · CVE-2025-48995

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SignXML versions prior to 4.0.4

Description The issue concerns a potential timing attack when verifying signatures with X509 certificate validation turned off and HMAC shared secret set. This could allow users to reconstruct the correct HMAC for any data by comparing the user-supplied hash with the correct HMAC, potentially leaking information about the correct HMAC. The signxml.XMLVerifier.verify function is used with require x509=False and hmac key set.

Recommendations For versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the verify function with require x509=False and hmac key set until a patch is available. Restrict access to the XMLVerifier class to minimize the risk of exploitation. Avoid using the hmac key parameter in the affected verify function until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2025-48995

GHSA-GMHF-GG8W-JW42

Affected Products

Signxml

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48995.json · Exploit
• https://osv.dev/vulnerability/GHSA-gmhf-gg8w-jw42 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48995 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-48995 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-48995 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-48995 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-48995 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-48995 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48995 · Security Note
• https://github.com/XML-Security/signxml/security/advisories/GHSA-gmhf-gg8w-jw42 · Note
• https://github.com/XML-Security/signxml/commit/1b501faaacf34cf978a52dbc6915ec11e27611cd · Note
• https://github.com/XML-Security/signxml · Note
• https://t.me/cvetracker/25202 · Telegram Post
• https://twitter.com/CVEnew/status/1929581583004013043 · Twitter Post