========================================================================
CVE-2025-40934                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2025-40934
   Distribution:  XML-Sig
       Versions:  from 0.27 before 0.68

       MetaCPAN:  https://metacpan.org/dist/XML-Sig
       VCS Repo:  https://github.com/perl-net-saml2/perl-XML-Sig

XML-Sig prior to 0.68 for Perl improperly validates XML without
signatures

Description
-----------
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML
files if signatures are omitted.

An attacker can remove the signature from the XML document to make it
pass the verification check.

XML-Sig is a Perl module to validate signatures on XML files.  An
unsigned XML file should return an error message.  The affected
versions return true when attempting to validate an XML file that
contains no signatures.

Problem types
-------------
- CWE-347 Improper Verification of Cryptographic Signature

Solutions
---------
Upgrade to version 0.68

References
----------
https://github.com/perl-net-saml2/perl-XML-Sig/issues/63
https://github.com/perl-net-saml2/perl-XML-Sig/pull/64

Credits
-------
gttds, finder