CVE-2023-49087 – Validation of SignedInfo

https://notcve.org/view.php?id=CVE-2023-49087

xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13. xml-security es una librería que implementa cifrado y firmas XML. La validación de una firma XML requiere verificar que el valor hash del documento XML relacionado coincida con un valor DigestValue específico, pero también que la firma criptográfica en el árbol SignedInfo (el que contiene el DigestValue) verifique y coincida con una clave pública confiable. • https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b5122317287581 https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6r • CWE-345: Insufficient Verification of Data Authenticity •