Homepage
About Snyk

xml-crypto@4.0.1 vulnerabilities

Xml digital signature and encryption library for Node.js

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the xml-crypto package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
Improper Verification of Cryptographic Signature

xml-crypto is a xml digital signature and encryption library for Node.js.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the default configuration not checking the authorization of the signer but only the validity of the signature. This oversight allows a malicious actor to re-sign an XML document and insert the certificate in a <KeyInfo /> element. Consequently, any certificate provided via a digitally signed XML document's <KeyInfo /> is trusted by default, even if the library was configured to use a specific certificate (publicCert) for signature verification purposes. An attacker can manipulate the XML document by replacing the existing signature with one generated with a malicious private key and attaching that private key's certificate to the <KeyInfo /> element.

How to fix Improper Verification of Cryptographic Signature?

Upgrade xml-crypto to version 6.0.0 or higher.

>=4.0.0 <6.0.0
Go back to all versions of this package