Potential Timing Attack in SignXML Implementation by XML Security

CVE-2025-48995

What is CVE-2025-48995?

The SignXML library, which implements the W3C XML Signature standard in Python, is susceptible to a timing attack due to its improper handling of signature verification. Specifically, when the X509 certificate validation is disabled and a shared HMAC key is used, the library may inadvertently leak information about the correct HMAC during hash comparisons. This vulnerability exists in SignXML versions prior to 4.0.4, allowing malicious users to exploit timing discrepancies to reconstruct valid HMAC values for arbitrary data, thereby compromising the integrity of the verification process. For details on the vulnerability, please visit the references provided.

References