CVE-2021-40690

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

• apache santuario xml security for java (< 2.1.7) • apache santuario xml security for java (>= 2.2.0 < 2.2.3) • apache cxf 3.4.4 • apache tomee (< 8.0.8) • debian debian linux 9.0 • debian debian linux 10.0 • debian debian linux 11.0 • oracle agile product lifecycle management 9.3.6 • oracle commerce guided search 11.3.2 • oracle commerce platform 11.3.2 • oracle communications diameter intelligence hub (>= 8.0.0 <= 8.1.0) • oracle communications diameter intelligence hub (>= 8.2.0 <= 8.2.3) • oracle communications messaging server 8.1 • oracle flexcube private banking 12.1.0 • oracle outside in technology 8.5.5 • oracle peoplesoft enterprise peopletools 8.58 • oracle peoplesoft enterprise peopletools 8.59 • oracle retail bulk data integration 16.0.3 • oracle retail financial integration 14.1.3.2 • oracle retail financial integration 15.0.3.1 • oracle retail financial integration 16.0.3 • oracle retail financial integration 19.0.1 • oracle retail integration bus 14.1.3.2 • oracle retail integration bus 15.0.3.1 • oracle retail integration bus 16.0.3 • oracle retail integration bus 19.0.1 • oracle retail merchandising system 16.0.3 • oracle retail merchandising system 19.0.1 • oracle retail service backbone 14.1.3.2 • oracle retail service backbone 15.0.3.1 • oracle retail service backbone 16.0.3 • oracle retail service backbone 19.0.1 • oracle weblogic server 12.2.1.4.0 • oracle weblogic server 14.1.1.0.0