CVE-2024-32962
1 advisory.
npm/xml-crypto CVE-2024-32962: critical 10, EPSS 0.83%
xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing
Action: Upgrade xml-crypto to 6.0.0 or later.
npm i xml-crypto@6.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 6.0.0 | - |
Fixed versions
| 6.0.0 |
Sources
- osv: GHSA-2xp3-57p7-qf4v
- https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v
- https://nvd.nist.gov/vuln/detail/CVE-2024-32962
- https://github.com/node-saml/xml-crypto/pull/301
- https://github.com/node-saml/xml-crypto/pull/445
- https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000
- https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca
- https://github.com/node-saml/xml-crypto
- https://github.com/node-saml/xml-crypto/discussions/399
- https://security.netapp.com/advisory/ntap-20240705-0003
- https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation
CVE-2024-32962 · published · modified · JSON