XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error message. The affected versions return true when attempting to validate an XML file that contains no signatures.
New features implemented: 1. User can specify Digest and Signature hashing algorithm 2. Support ECDSA signatures
TBD Update Changes and Increment version dd9c915 Fixes #21 Implement ecdsa signature support 32d7a5c Merge pull request #24 from perl-net-saml2/digest-config 4b900c6 Improve support for configurable Digest Hashing Algorithms e511b66 Improve support for configurable Signature Algorithms e4a27f7 fix pod formatting