CVE-2014-8152 Improper Input Validation in Apache Santuario XML Security
MediumCVSS 5.0
EPSS 5.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.santuario/xmlsec(Maven) | >= 2.0.0, < 2.0.3 | 2.0.3 |
| org.apache.santuario/xmlsec(Maven) | = 2.0.0 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | = 2.0.1 | No fix listed |
| org.apache.santuario/xmlsec(Maven) | = 2.0.2 | No fix listed |
| apache santuario xml security for java | = 2.0.0 | No fix listed |
| apache santuario xml security for java | = 2.0.1 | No fix listed |
| apache santuario xml security for java | = 2.0.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- apache-santuario-cve20148152-sec-bypass(99993) vdb-entry
- github.com product
- lists.apache.org
- lists.apache.org
- svn.apache.org
- santuario.apache.org vendor-advisory
- [oss-security] 20150119 New Apache Santuario security advisory CVE-2014-8152 mailing-list
- github.com
- 72115 vdb-entry
- 1031556 vdb-entry
- [santuario-commits] 20190823 svn commit: r1049214 - in /websites/production/santuario/content: cache/main.pageCache download.html index.html javaindex.html javareleasenotes.html secadv.data/CVE-2019-12400.asc secadv.html mailing-list
- [santuario-commits] 20210917 svn commit: r1076843 - in /websites/production/santuario/content: cache/main.pageCache index.html javaindex.html secadv.data/CVE-2021-40690.txt.asc secadv.html mailing-list
- Debian Security Tracker CVE-2014-8152 vendor-advisory