Improper Input Validation The advisory has been revoked - it doesn't affect any version of package libxml-security-java (opens in a new tab)

Threat Intelligence

0.78% (51^st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-DEBIAN8-LIBXMLSECURITYJAVA-460268
published23 Aug 2019
disclosed23 Aug 2019

Report a new vulnerability Found a mistake?

Introduced: 23 Aug 2019

CVE-2019-12400 (opens in a new tab) CWE-20 (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml-security-java package and not the libxml-security-java package as distributed by Debian.

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.