Potential Algorithm Confusion Attack in python-signxml Package
Summary
UBUNTU-CVE-2025-48994: SignXML is an implementation of the W3C XML Signature standard in Python. Affects python-signxml versions 4.0.2+dfsg-1 – 4.0.3+dfsg-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-signxml package is an implementation of the W3C XML Signature standard in Python, enabling users to sign and verify XML documents. It is widely used for secure data exchange in applications that require XML signatures. However, certain configurations can expose users to vulnerabilities, particularly when signature verification is not properly restricted.
Vulnerability Detail
The vulnerability arises when verifying signatures with X509 certificate validation turned off and an HMAC shared secret set. In versions prior to 4.0.4, the XMLVerifier can be exploited through an algorithm confusion attack. An attacker may provide a signature signed with a different asymmetric key algorithm, potentially compromising the integrity of the verification process. This occurs unless the user explicitly limits the expected signature algorithms, which can lead to unauthorized access or data manipulation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can explicitly limit the expected signature algorithms by using the following code snippet when verifying signatures: 'signxml.XMLVerifier.verify(expect_config=...)'. This ensures that only the desired algorithms are accepted during the verification process.
Conclusion
The python-signxml package has a vulnerability that can be exploited through an algorithm confusion attack if not properly configured. Users are encouraged to update to version 4.0.4 or later to mitigate this risk. Implementing the provided workaround can also help secure applications until an update can be performed.
See every vulnerability recorded for python-signxml →
FAQ
The main issue is a potential algorithm confusion attack when verifying signatures without proper restrictions, which can lead to security vulnerabilities.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions prior to 4.0.4 of python-signxml are vulnerable to this issue.
If an immediate update is not possible, you should implement the workaround by restricting the expected signature algorithms during verification.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for python-signxml.
