{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "xml-crypto"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-10-27T20:35:52Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nAn attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation.\n\n### Patches\nVersion 2.0.0 has the fix.\n\n### Workarounds\nThe recommendation is to upgrade. In case that is not possible remove the \u0027http://www.w3.org/2000/09/xmldsig#hmac-sha1\u0027 entry from SignedXml.SignatureAlgorithms.",
  "id": "GHSA-c27r-x354-4m68",
  "modified": "2022-08-02T20:03:05Z",
  "published": "2020-10-27T20:39:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yaronn/xml-crypto/security/advisories/GHSA-c27r-x354-4m68"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yaronn/xml-crypto/commit/3d9db712e6232c765cd2ad6bd2902b88a0d22100"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yaronn/xml-crypto"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/xml-crypto"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "xml-crypto\u0027s HMAC-SHA1 signatures can bypass validation via key confusion"
}