CVE-2020-15216: 
Linux Debian vulnerability analysis and mitigation

CVE-2020-15216 is a critical vulnerability in the goxmldsig library, a pure Go implementation of XML Digital Signatures. The vulnerability was discovered and disclosed on September 29, 2020. The affected versions are 1.1.0 and earlier of the github.com/russellhaering/goxmldsig package (GitHub Advisory).

The vulnerability is classified as CWE-347 (Improper Verification of Cryptographic Signature). With a carefully crafted XML file, an attacker could completely bypass signature validation and pass off an altered file as a signed one (GitHub Advisory).

The vulnerability allows attackers to bypass signature validation completely, which means they could forge signed XML documents that would be accepted as valid. This has serious implications for systems relying on XML digital signatures for authentication or integrity verification (GitHub Advisory).

The vulnerability can be exploited using a carefully crafted XML file. The severity is rated as Critical, indicating a high likelihood of exploitation (GitHub Advisory).

A patch is available in version 1.1.0 of the goxmldsig library. All users are recommended to upgrade to this version or later. The fix includes validation of signature object shape prior to processing (Fedora Update).