Homepage
About Snyk

org.apache.santuario:xmlsec@2.0.0 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.santuario:xmlsec package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Insertion of Sensitive Information into Log File

org.apache.santuario:xmlsec is a package to provide implementation of the primary security standards for XML, XML-Signature Syntax and Processing and XML Encryption Syntax and Processing.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File when using the JSR 105 API. An attacker can disclose a private key in log files by generating an XML Signature and enabling logging with debug level.

How to fix Insertion of Sensitive Information into Log File?

Upgrade org.apache.santuario:xmlsec to version 2.2.6, 2.3.4, 3.0.3 or higher.

[,2.2.6) [2.3.0,2.3.4) [3.0.0,3.0.3)
  • M
Improper Input Validation

org.apache.santuario:xmlsec is a package to provide implementation of the primary security standards for XML, XML-Signature Syntax and Processing and XML Encryption Syntax and Processing.

Affected versions of this package are vulnerable to Improper Input Validation due to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

How to fix Improper Input Validation?

Upgrade org.apache.santuario:xmlsec to version 2.2.3, 2.1.7 or higher.

[2.2.0,2.2.3) [,2.1.7)
  • M
Security Features

org.apache.santuario:xmlsec For certain XML documents, it is possible to modify the document and the streaming XML Signature verification code will not report an error when trying to validate the signature.

Please note that the "in-memory" (DOM) API for XML Signature is not affected by this issue, nor is the JSR-105 API. Also, web service stacks that use the streaming functionality of Apache Santuario (such as Apache CXF/WSS4J) are also not affected by this vulnerability.

[2.0.0,2.0.2]
Go back to all versions of this package