Algorithm Confusion Vulnerability in SignXML Package
Summary
CVE-2025-48994: SignXML is an implementation of the W3C XML Signature standard in Python. Affects python-signxml across 2 version ranges.
< 4.0.5+dfsg-1
< e3c0c2b82a3329a65d917830657649c98b8c7600
Fixed in 4.0.5+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SignXML is a Python library that implements the W3C XML Signature standard, allowing users to create and verify XML signatures. It is widely used for ensuring the integrity and authenticity of XML data. The library supports various signature algorithms and provides flexibility in signature verification. However, certain configurations can expose users to security risks, particularly when X509 certificate validation is disabled and HMAC keys are used without proper restrictions.
Vulnerability Detail
The vulnerability identified as CVE-2025-48994 arises when using the SignXML library versions prior to 4.0.4 with X509 certificate validation turned off and an HMAC shared secret set. In this scenario, an attacker can exploit the lack of restrictions on expected signature algorithms, potentially leading to an algorithm confusion attack. This allows the attacker to supply a signature that is signed with a different asymmetric key algorithm rather than the intended HMAC key, which could compromise the integrity of the signature verification process.
How To Fix
Minimum fixed version
4.0.5+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-signxmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually restrict the expected signature algorithms by specifying the expect_config parameter in the verification method. For example: verifier.verify(expect_config={'algorithms': ['HMAC']}).
Conclusion
The CVE-2025-48994 vulnerability in the SignXML package poses significant risks when signature verification is not properly configured. Users are strongly advised to update to version 4.0.4 or later and implement necessary restrictions on expected signature algorithms to safeguard their applications.
See every vulnerability recorded for python-signxml →
FAQ
CVE-2025-48994 is a vulnerability in the SignXML package that allows for potential algorithm confusion attacks when verifying signatures without proper restrictions.
Versions of SignXML prior to 4.0.4 are vulnerable to this issue.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If an immediate update is not possible, ensure to restrict the expected signature algorithms using the expect_config parameter in the verification method as a temporary measure.
Vulert is a tool that monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities, helping you maintain the security of your applications.
Related vulnerabilities
Recent vulnerabilities recorded for python-signxml.
