Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

影響: go:github.com/moov-io/signedxml <= 1.4.0 → 1.4.1 Exclusive XML canonicalization (http://www.w3.org/2001/10/xml-exc-c14n#) in github.com/moov-io/signedxml copied the entire accumulated namespace map at every node during ValidateReferences(), before any reference digest or signature check. For a chain of nested elements that each declare many unused namespace prefixes, that produced O(m × depth²) time and peak memory (m = prefixes per level). beevik/etree caps tree depth (~1024), but m is unbounded, so a small attacker-controlled document (on t…

GitHub Advisory Databaseで読む