This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2020-15216 →
DEBIAN-CVE-2020-15216
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypas...
Original description
The description as published by the source.
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
golang-github-russellhaering-goxmldsig
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1"}]}]
References
- advisory security-tracker.debian.org