CVE-2013-2172 Inefficient Algorithmic Complexity in Apache Santuario XML Security
MediumCVSS 4.3
EPSS 5.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.santuario/xmlsec(Maven) | >= 1.4.0, < 1.4.8 | 1.4.8 |
| org.apache.santuario/xmlsec(Maven) | = 1.4.0 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | = 1.4.1 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | = 1.4.2 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | = 1.4.3 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | = 1.4.4 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | = 1.4.5 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | = 1.4.6 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | = 1.4.7 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | >= 1.5.0, < 1.5.5 | 1.5.5 |
| org.apache.santuario/xmlsec(Maven) | = 1.5.0 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | = 1.5.1 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | = 1.5.2 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | = 1.5.3 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | = 1.5.4 | No fix listed |
| debian/libxml-security-java(Debian:12) | < 1.5.5-2 | 1.5.5-2 |
| debian/libxml-security-java(Debian:13) | < 1.5.5-2 | 1.5.5-2 |
| debian/libxml-security-java(Debian:14) | < 1.5.5-2 | 1.5.5-2 |
| apache santuario xml security for java | = 1.4.7 | No fix listed |
| apache santuario xml security for java | = 1.5.0 | No fix listed |
| apache santuario xml security for java | = 1.5.1 | No fix listed |
| apache santuario xml security for java | = 1.5.2 | No fix listed |
| apache santuario xml security for java | = 1.5.3 | No fix listed |
| apache santuario xml security for java | = 1.5.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com product
- [santuario-commits] 20190823 svn commit: r1049214 - in /websites/production/santuario/content: cache/main.pageCache download.html index.html javaindex.html javareleasenotes.html secadv.data/CVE-2019-12400.asc secadv.html mailing-list
- lists.apache.org
- [santuario-commits] 20210917 svn commit: r1076843 - in /websites/production/santuario/content: cache/main.pageCache index.html javaindex.html secadv.data/CVE-2021-40690.txt.asc secadv.html mailing-list
- lists.apache.org
- web.archive.org
- web.archive.org
- RHSA-2013:1207 vendor-advisory
- RHSA-2013:1208 vendor-advisory
- RHSA-2013:1209 vendor-advisory
- RHSA-2013:1217 vendor-advisory
- RHSA-2013:1218 vendor-advisory
- RHSA-2013:1219 vendor-advisory
- RHSA-2013:1220 vendor-advisory
- RHSA-2013:1375 vendor-advisory
- RHSA-2013:1437 vendor-advisory
- RHSA-2013:1853 vendor-advisory
- RHSA-2014:0212 vendor-advisory
- santuario.apache.org vendor-advisory
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list
- svn.apache.org patch
- DSA-3065 vendor-advisory
- www.oracle.com
- USN-2028-1 vendor-advisory
- www.vmware.com
- github.com
- Debian Security Tracker CVE-2013-2172 vendor-advisory
- 54019 third-party-advisory vendor-advisory
- 94651 vdb-entry
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list
- 60846 vdb-entry
- bugs.debian.org issue-tracking