CVE-2020-15216

Name of the Vulnerable Software and Affected Versions goxmldsig versions prior to 1.1.0

Description The issue allows an attacker to bypass signature validation with a carefully crafted XML file, making it possible to pass off an altered file as a signed one. This is due to the behavior of encoding/xml, which can cause XML Digital Signature validation to be entirely bypassed.

Recommendations For goxmldsig versions prior to 1.1.0, upgrade to at least version 1.1.0 to resolve the issue. As a temporary workaround, consider restricting the use of the encoding/xml module until a patch is applied.