GitHub Advisoryadvisory · Maven

GHSA-4p4w-6h54-g885 Improper Input Validation in Apache Santuario XML Security

MEDIUM Published 2022-05-13 Modified 2024-03-05 Official page ↗
Aliases
CVE-2013-4517
Ecosystem
Maven
Packages
org.apache.santuario:xmlsec
Severity
Moderate
Weaknesses
CWE-20
Reviewed
2022-07-07

Affected packages

• Maven org.apache.santuario:xmlsec: < 1.5.6 → fixed in 1.5.6

Description

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.

Related

Alias · CVE (1)

  • CVE-2013-4517 Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References