SignXML Timing Attack Vulnerability in HMAC Verification

A timing attack vulnerability has been identified in SignXML, a Python library implementing the W3C XML Signature standard. This issue affects versions prior to 4.0.4 when verifying signatures with X509 certificate validation disabled and HMAC shared secret enabled. In this scenario, the verifier may inadvertently leak information about the correct HMAC by comparing it with the user-supplied hash. This leakage could allow users to reconstruct the correct HMAC for any given data.

Impact

Exploitation of this vulnerability could lead to a timing attack, allowing an attacker to infer information about the HMAC verification process and potentially reconstruct the correct HMAC for signed data.

Remediation

Users can upgrade to SignXML version 4.0.4 or later to address this vulnerability.