GitHub Advisoryadvisory · Maven

GHSA-r237-w2w6-jq3p Inefficient Algorithmic Complexity in Apache Santuario XML Security

MEDIUM Published 2022-05-13 Modified 2024-03-05 Official page ↗
Aliases
CVE-2013-2172
Ecosystem
Maven
Packages
org.apache.santuario:xmlsec
Severity
Moderate
Weaknesses
CWE-407
Reviewed
2022-07-08

Affected packages

• Maven org.apache.santuario:xmlsec: >= 1.4.0, < 1.4.8 → fixed in 1.4.8 • Maven org.apache.santuario:xmlsec: >= 1.5.0, < 1.5.5 → fixed in 1.5.5

Description

`jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java` in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."

Related

Alias · CVE (1)

  • CVE-2013-2172 jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before… vulnerability

Weakness · CWE (1)

  • CWE-407 Inefficient Algorithmic Complexity weakness

References