In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully     crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a     signed one. A patch is available, all users of goxmldsig should upgrade to at least revision     f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0 (CVE-2020-15216)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully
    crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a
    signed one. A patch is available, all users of goxmldsig should upgrade to at least revision
    f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0 (CVE-2020-15216)

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-9316ee2948 advisory.

  - In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully     crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a     signed one. A patch is available, all users of goxmldsig should upgrade to at least revision     f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0 (CVE-2020-15216)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-a2a7673da2 advisory.

  - In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully     crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a     signed one. A patch is available, all users of goxmldsig should upgrade to at least revision     f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0 (CVE-2020-15216)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
257069	Linux Distros Unpatched Vulnerability : CVE-2020-15216	Nessus	Misc.	medium
431892	SCA: security update for github.com/russellhaering/goxmldsig (GHSA-q547-gmf8-8jr7)	Tenable Cloud Security	SCA Checks	medium
431892	SCA: security update for github.com/russellhaering/goxmldsig (GHSA-q547-gmf8-8jr7)	Tenable Self-Hosted Container Security	SCA Checks	medium
144958	Fedora 32 : golang-github-russellhaering-goxmldsig (2021-9316ee2948)	Nessus	Fedora Local Security Checks	medium
144954	Fedora 33 : golang-github-russellhaering-goxmldsig (2021-a2a7673da2)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2020-15216

medium

Tenable Plugins

medium

medium

medium

medium

medium