CVE-2025-48995

Name	CVE-2025-48995
Description	SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential timing attack. The verifier may leak information about the correct HMAC when comparing it with the user supplied hash, allowing users to reconstruct the correct HMAC for any data.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1107195

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-signxml (PTS)	trixie	4.0.3+dfsg-1	vulnerable
	sid	4.0.5+dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-signxml	source	(unstable)	4.0.5+dfsg-1			1107195

Notes

https://github.com/XML-Security/signxml/security/advisories/GHSA-gmhf-gg8w-jw42
Fixed by: https://github.com/XML-Security/signxml/commit/1b501faaacf34cf978a52dbc6915ec11e27611cd (v4.0.4)