GitHub Advisoryadvisory · Maven

GHSA-xfrj-6vvc-3xm2 Apache Santuario - XML Security for Java are vulnerable to private key disclosure

MEDIUM Published 2023-10-20 Modified 2025-11-04 Official page ↗
Aliases
CVE-2023-44483
Ecosystem
Maven
Packages
org.apache.santuario:xmlsec
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2023-10-20

Affected packages

• Maven org.apache.santuario:xmlsec: >= 2.3.0, < 2.3.4 → fixed in 2.3.4 • Maven org.apache.santuario:xmlsec: < 2.2.6 → fixed in 2.2.6 • Maven org.apache.santuario:xmlsec: >= 3.0.0, < 3.0.3 → fixed in 3.0.3

Description

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2023-44483 All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References