org.apache.santuario:xmlsec@2.0.10 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.santuario:xmlsec package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Insertion of Sensitive Information into Log File

org.apache.santuario:xmlsec is a package to provide implementation of the primary security standards for XML, XML-Signature Syntax and Processing and XML Encryption Syntax and Processing.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File when using the JSR 105 API. An attacker can disclose a private key in log files by generating an XML Signature and enabling logging with debug level.

How to fix Insertion of Sensitive Information into Log File?

Upgrade org.apache.santuario:xmlsec to version 2.2.6, 2.3.4, 3.0.3 or higher.

[,2.2.6) [2.3.0,2.3.4) [3.0.0,3.0.3)
  • M
Improper Input Validation

org.apache.santuario:xmlsec is a package to provide implementation of the primary security standards for XML, XML-Signature Syntax and Processing and XML Encryption Syntax and Processing.

Affected versions of this package are vulnerable to Improper Input Validation due to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

How to fix Improper Input Validation?

Upgrade org.apache.santuario:xmlsec to version 2.2.3, 2.1.7 or higher.

[2.2.0,2.2.3) [,2.1.7)
  • M
XML External Entity (XXE) Injection

org.apache.santuario:xmlsec is a package to provide implementation of the primary security standards for XML, XML-Signature Syntax and Processing and XML Encryption Syntax and Processing.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. In version 2.0.3 a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc.

How to fix XML External Entity (XXE) Injection?

Upgrade org.apache.santuario:xmlsec to version 2.1.4 or higher.

[2.0.3,2.1.4)