debian/python-signxml vulnerabilities

Latest debian/python-signxml CVEs

Newest publication first

1. CVE-2025-48995 SignXML's signature verification with HMAC is vulnerable to a timing attack

   Published 2025-06-02

   Medium·CVSS 6.9 EPSS 0.24%

   SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (signxml.XMLVerifier.verify(require_x509=False, hmac_key=...), versions of SignXML prior to 4.0.4 are vulnera...

2. CVE-2025-48994 SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack

   Published 2025-06-02

   Medium·CVSS 6.9 EPSS 0.23%

   SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (signxml.XMLVerifier.verify(require_x509=False, hmac_key=...), versions of SignXML prior to 4.0.4 are vulnera...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.