npm/xml-crypto: high

xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

Action: Upgrade xml-crypto to 2.0.0 or later.

npm i xml-crypto@2.0.0

Affected

Fixed versions

Sources

• osv: GHSA-c27r-x354-4m68
• https://github.com/yaronn/xml-crypto/security/advisories/GHSA-c27r-x354-4m68
• https://github.com/yaronn/xml-crypto/commit/3d9db712e6232c765cd2ad6bd2902b88a0d22100
• https://github.com/yaronn/xml-crypto
• https://www.npmjs.com/package/xml-crypto

published 2020-10-27T20:39:46Z · modified 2022-08-02T20:03:05Z · JSON