Improper Input Validation Affecting org.apache.santuario:xmlsec package, versions [2.2.0,2.2.3) [,2.1.7)


0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.14% (49th percentile)
Expand this section
NVD
7.5 high
Expand this section
Red Hat
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGAPACHESANTUARIO-1655558
  • published 20 Sep 2021
  • disclosed 20 Sep 2021
  • credit Unknown

How to fix?

Upgrade org.apache.santuario:xmlsec to version 2.2.3, 2.1.7 or higher.

Overview

org.apache.santuario:xmlsec is a package to provide implementation of the primary security standards for XML, XML-Signature Syntax and Processing and XML Encryption Syntax and Processing.

Affected versions of this package are vulnerable to Improper Input Validation due to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.