CVE-2023-34205: Signature validation bypass in github.com/moov-io/signedxml

Severity: Critical

CVSS Score: 9.1

In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).