-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| signxml | pip | < 4.0.4 | 4.0.4 |
Miggo AIRoot Cause AnalysisThe vulnerability, as described, occurs when signxml.XMLVerifier.verify is called with require_x509=False and an hmac_key is set, but without explicitly restricting expect_config to HMAC algorithms. The provided patch directly modifies the verify method in signxml/verifier.py to address this. The patch introduces logic at the beginning of the verify method to check if an hmac_key is provided. If it is, and if the expect_config.signature_methods is still at its default (meaning the user hasn't specifically configured it), the signature_methods are automatically restricted to only HMAC-based algorithms. If the user has configured signature_methods but they include non-HMAC algorithms while an hmac_key is also set, an InvalidInput exception is raised. This change directly mitigates the algorithm confusion by ensuring that the presence of an hmac_key enforces the use of HMAC algorithms. Therefore, the verify method is the function that contained the vulnerability because it lacked this enforcement, allowing for the processing of signatures with unexpected algorithms.