CVE-2023-49087

    Dashboard / Vulnerabilities / CVE-2023-49087

    CVE-2023-49087

    Published: 30 Nov 2023Last Modified: 28 Oct 2026

    Summary: Validation of SignedInfo

    Details: xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49087.json, https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6r, https://nvd.nist.gov/vuln/detail/CVE-2023-49087, https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b5122317287581

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- f9029fcbcca731136dab58c687e3a55b68c962ce
    Fixed -f509e3083dd7870cce5880c804b5122317287581

    Affected versions

    1.6.11

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-49087 | CVE-DB