Xml
Monthly
Signature verification bypass in XML::Sig (Perl) versions 0.29 through 0.71 allows remote unauthenticated attackers to submit arbitrary XML documents that are accepted as cryptographically valid without any digest or key check ever running. The verify() function unconditionally returns true after looping over all dsig:Signature elements, even when every iteration exited early via a skip path before cryptographic validation. No public exploit has been identified beyond the proof-of-concept test case embedded in the fix commit, and this vulnerability is not currently listed in the CISA KEV catalog.
Signature verification bypass in the Perl XML::Sig module before 0.71 allows XML Signature Wrapping (XSW) via duplicate ID attributes, letting attackers forge signed content that still validates. verify() resolves a signed Reference URI with the XPath "//*[@ID='$id']" and trusts the first matching node, so a document containing two elements with the same ID passes verification while a downstream consumer reads the attacker-supplied second element; in a SAML2 SP this puts Assertion contents under attacker control. Rated CVSS 9.1 (network, no authentication, no user interaction); no public exploit identified at time of analysis, though the vendor's fix ships a regression test that reproduces the technique.
Signature-verification bypass in the Perl XML::Sig module before 0.71 allows remote attackers to forge which document node is validated by injecting XPath operators through the SignedInfo/Reference/@URI attribute. Because verify() and _get_signed_xml() concatenate the attacker-controlled URI into an XPath expression without escaping or NCName validation, a single quote breaks out of the string literal and lets the injected expression decide which element is digest-checked - undermining the integrity guarantee of any XML Signature the library verifies. No public exploit has been identified at time of analysis, and the flaw is not on CISA KEV; a vendor patch exists in release 0.71.
Out-of-bounds read in the XML::Bare Perl XML parser (all releases through 0.53) lets a remote attacker crash the parsing process or disclose small amounts of adjacent process memory by feeding it a truncated or malformed XML document. The parserc_parse C routine performs multi-character lookahead (for tokens like '<![CDATA[' and element terminators) without verifying the offsets stay inside the input buffer, so inputs such as '<a/' read past the end. There is no public exploit identified at time of analysis and EPSS is low (0.19%), but SSVC rates the flaw automatable, reflecting how easily malformed XML can be delivered to any service that parses untrusted input with this module.
Denial of service in the Perl XML::Bare module (versions through 0.53) allows remote attackers to force an infinite loop by submitting malformed XML attributes to any application that parses attacker-controlled input with the library. The parserc_parse function fails to advance its cursor on certain malformed attribute forms, causing 100% CPU consumption and unresponsiveness. No public exploit identified at time of analysis, but the trivial reproducer strings published in the oss-security advisory make triggering it straightforward.
Out-of-bounds heap read in XML::LibXML for Perl (all versions through 2.0210) allows remote attackers to trigger denial-of-service crashes by supplying XML node names with truncated UTF-8 sequences. The parser fails to validate multi-byte UTF-8 boundaries in node names, reading past allocated memory into adjacent heap regions. No public exploit identified at time of analysis, with EPSS score of 0.01% indicating very low observed exploitation probability. Vendor-released patch available via upstream commit 15652bd9.
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Signature verification bypass in XML::Sig (Perl) versions 0.29 through 0.71 allows remote unauthenticated attackers to submit arbitrary XML documents that are accepted as cryptographically valid without any digest or key check ever running. The verify() function unconditionally returns true after looping over all dsig:Signature elements, even when every iteration exited early via a skip path before cryptographic validation. No public exploit has been identified beyond the proof-of-concept test case embedded in the fix commit, and this vulnerability is not currently listed in the CISA KEV catalog.
Signature verification bypass in the Perl XML::Sig module before 0.71 allows XML Signature Wrapping (XSW) via duplicate ID attributes, letting attackers forge signed content that still validates. verify() resolves a signed Reference URI with the XPath "//*[@ID='$id']" and trusts the first matching node, so a document containing two elements with the same ID passes verification while a downstream consumer reads the attacker-supplied second element; in a SAML2 SP this puts Assertion contents under attacker control. Rated CVSS 9.1 (network, no authentication, no user interaction); no public exploit identified at time of analysis, though the vendor's fix ships a regression test that reproduces the technique.
Signature-verification bypass in the Perl XML::Sig module before 0.71 allows remote attackers to forge which document node is validated by injecting XPath operators through the SignedInfo/Reference/@URI attribute. Because verify() and _get_signed_xml() concatenate the attacker-controlled URI into an XPath expression without escaping or NCName validation, a single quote breaks out of the string literal and lets the injected expression decide which element is digest-checked - undermining the integrity guarantee of any XML Signature the library verifies. No public exploit has been identified at time of analysis, and the flaw is not on CISA KEV; a vendor patch exists in release 0.71.
Out-of-bounds read in the XML::Bare Perl XML parser (all releases through 0.53) lets a remote attacker crash the parsing process or disclose small amounts of adjacent process memory by feeding it a truncated or malformed XML document. The parserc_parse C routine performs multi-character lookahead (for tokens like '<![CDATA[' and element terminators) without verifying the offsets stay inside the input buffer, so inputs such as '<a/' read past the end. There is no public exploit identified at time of analysis and EPSS is low (0.19%), but SSVC rates the flaw automatable, reflecting how easily malformed XML can be delivered to any service that parses untrusted input with this module.
Denial of service in the Perl XML::Bare module (versions through 0.53) allows remote attackers to force an infinite loop by submitting malformed XML attributes to any application that parses attacker-controlled input with the library. The parserc_parse function fails to advance its cursor on certain malformed attribute forms, causing 100% CPU consumption and unresponsiveness. No public exploit identified at time of analysis, but the trivial reproducer strings published in the oss-security advisory make triggering it straightforward.
Out-of-bounds heap read in XML::LibXML for Perl (all versions through 2.0210) allows remote attackers to trigger denial-of-service crashes by supplying XML node names with truncated UTF-8 sequences. The parser fails to validate multi-byte UTF-8 boundaries in node names, reading past allocated memory into adjacent heap regions. No public exploit identified at time of analysis, with EPSS score of 0.01% indicating very low observed exploitation probability. Vendor-released patch available via upstream commit 15652bd9.
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.