SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential algorithm confusion attack. Unless the user explicitly limits the expected signature algorithms using the `signxml.XMLVerifier.verify(expect_config=...)` setting, an attacker may supply a signature unexpectedly signed with a key other than the provided HMAC key, using a different (asymmetric key) signature algorithm. Starting with SignXML 4.0.4, specifying `hmac_key` causes the set of accepted signature algorithms to be restricted to HMAC only, if not already restricted by the user.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with     X509 certificate validation turned off and HMAC shared secret set     (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are     vulnerable to a potential algorithm confusion attack. Unless the user explicitly limits the expected     signature algorithms using the `signxml.XMLVerifier.verify(expect_config=...)` setting, an attacker may     supply a signature unexpectedly signed with a key other than the provided HMAC key, using a different     (asymmetric key) signature algorithm. Starting with SignXML 4.0.4, specifying `hmac_key` causes the set of     accepted signature algorithms to be restricted to HMAC only, if not already restricted by the user.
    (CVE-2025-48994)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with
    X509 certificate validation turned off and HMAC shared secret set
    (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are
    vulnerable to a potential algorithm confusion attack. Unless the user explicitly limits the expected
    signature algorithms using the `signxml.XMLVerifier.verify(expect_config=...)` setting, an attacker may
    supply a signature unexpectedly signed with a key other than the provided HMAC key, using a different
    (asymmetric key) signature algorithm. Starting with SignXML 4.0.4, specifying `hmac_key` causes the set of
    accepted signature algorithms to be restricted to HMAC only, if not already restricted by the user.
    (CVE-2025-48994)

ID	Name	Product	Family	Type	Severity
264326	Linux Distros Unpatched Vulnerability : CVE-2025-48994	Nessus	Misc.	Local	medium
427839	SCA: security update for signxml (GHSA-6vx8-pcwv-xhf4)	Tenable Cloud Security	SCA Checks	Local	medium
427839	SCA: security update for signxml (GHSA-6vx8-pcwv-xhf4)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-48994

medium

Tenable Plugins

medium

medium

medium