Timing Attack Vulnerability in SignXML Package - CVE-2025-48995
Summary
CVE-2025-48995: SignXML is an implementation of the W3C XML Signature standard in Python. Affects python-signxml across 2 version ranges.
< 1b501faaacf34cf978a52dbc6915ec11e27611cd
< 4.0.5+dfsg-1
Fixed in 4.0.5+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SignXML is a Python library that implements the W3C XML Signature standard, enabling users to create and verify XML signatures. It is widely used for securing XML data exchanges in various applications. The library provides features such as HMAC signing and verification, but certain configurations can expose it to security risks.
Vulnerability Detail
The vulnerability identified as CVE-2025-48995 affects versions of the SignXML package prior to 4.0.4. When the XML verifier is configured to disable X509 certificate validation and uses a shared HMAC key, it becomes susceptible to a timing attack. This flaw allows an attacker to glean information about the correct HMAC by analyzing the time taken to compare the user-supplied hash with the correct one. Consequently, this could enable the reconstruction of the correct HMAC for any data, compromising the integrity of the signatures.
How To Fix
Minimum fixed version
4.0.5+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-signxmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the require_x509=False setting when verifying signatures. Instead, ensure that X509 certificate validation is enabled to mitigate the risk of timing attacks.
Conclusion
The CVE-2025-48995 vulnerability in the SignXML package poses a significant risk when signatures are verified without proper X509 certificate validation. Users are strongly encouraged to update to version 4.0.4 or later to ensure their applications remain secure. For those unable to update immediately, enabling X509 validation serves as a temporary workaround.
See every vulnerability recorded for python-signxml →
FAQ
CVE-2025-48995 is a vulnerability in the SignXML package that allows for potential timing attacks when verifying signatures without X509 certificate validation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow an attacker to reconstruct the correct HMAC for any data, potentially compromising the integrity of XML signatures.
Yes, the vulnerability has been patched in version 4.0.4 of the SignXML package. Updating to this version will mitigate the risk.
If an immediate update is not possible, consider enabling X509 certificate validation in your signature verification process to reduce the risk of timing attacks.
Related vulnerabilities
Recent vulnerabilities recorded for python-signxml.
