org.apache.santuario:xmlsec@2.0.10 vulnerabilities
-
latest version
4.0.2
-
latest non vulnerable version
-
first published
18 years ago
-
latest version published
9 months ago
-
licenses detected
- [0,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.apache.santuario:xmlsec package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.| Vulnerability | Vulnerable Version |
|---|---|
org.apache.santuario:xmlsec is a package to provide implementation of the primary security standards for XML, XML-Signature Syntax and Processing and XML Encryption Syntax and Processing. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File when using the JSR 105 API. An attacker can disclose a private key in log files by generating an XML Signature and enabling logging with debug level. How to fix Insertion of Sensitive Information into Log File? Upgrade |
[,2.2.6)
[2.3.0,2.3.4)
[3.0.0,3.0.3)
|
org.apache.santuario:xmlsec is a package to provide implementation of the primary security standards for XML, XML-Signature Syntax and Processing and XML Encryption Syntax and Processing. Affected versions of this package are vulnerable to Improper Input Validation due to an issue where the "secureValidation" property is not passed correctly when creating a How to fix Improper Input Validation? Upgrade |
[2.2.0,2.2.3)
[,2.1.7)
|
org.apache.santuario:xmlsec is a package to provide implementation of the primary security standards for XML, XML-Signature Syntax and Processing and XML Encryption Syntax and Processing. Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. In version 2.0.3 a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. How to fix XML External Entity (XXE) Injection? Upgrade |
[2.0.3,2.1.4)
|