Releases: XML-Security/signxml
Releases · XML-Security/signxml
v4.0.5
v4.0.4: This release contains security fixes for two security advisories:
This release contains security fixes for two security advisories:
-
Signature verification with HMAC is vulnerable to an algorithm confusion attack
(GHSA-6vx8-pcwv-xhf4) -
Signature verification with HMAC is vulnerable to a timing attack
(GHSA-gmhf-gg8w-jw42)
v4.0.3: - Fix issue with support for deprecated PyOpenSSL certificates
-
Fix issue with support for deprecated PyOpenSSL certificates
- Fully remove the ca_path parameter; add docs for signature location pinning
v4.0.2
v4.0.1
v4.0.0: - Replace PyOpenSSL with Cryptography (#260)
-
Replace PyOpenSSL with Cryptography (#260)
- This is a major infrastructure change that replaces core certificate parsing, key processing, signature validation, and certificate chain validation functions previously provided by PyOpenSSL with those provided by Cryptography. Care was taken to preserve the exisitng API, including exception types, but many error messages raised in various error conditions have changed. If you see unexpected behavior and you have reason to believe it is incorrect, please file an issue. - Breaking change: the ca_path parameter, previously used to specify CA certificate stores, is no longer supported. Use the ca_pem_file parameter instead.-
Raise error when invalid certificate string is passed as input to signer
-
Fix public key matching for ECDSA (#245)
-
v3.2.2: - Update upper bound on lxml dependency to allow lxml 5
-
Update upper bound on lxml dependency to allow lxml 5
-
Bump minimum dependency versions to align with Ubuntu 20.04
-
Test and release infrastructure improvements
-
