Improper Input Validation Affecting org.apache.santuario:xmlsec package, versions [2.2.0,2.2.3) [,2.1.7)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHESANTUARIO-1655558
- published 20 Sep 2021
- disclosed 20 Sep 2021
- credit Unknown
Introduced: 20 Sep 2021
CVE-2021-40690 Open this link in a new tabHow to fix?
Upgrade org.apache.santuario:xmlsec to version 2.2.3, 2.1.7 or higher.
Overview
org.apache.santuario:xmlsec is a package to provide implementation of the primary security standards for XML, XML-Signature Syntax and Processing and XML Encryption Syntax and Processing.
Affected versions of this package are vulnerable to Improper Input Validation due to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.