Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
- Snyk ID SNYK-JAVA-ORGAPACHESANTUARIO-30032
- published 20 Jan 2015
- disclosed 20 Jan 2015
- credit Jaime Pallarés Rel
For certain XML documents, it is possible to modify the document and the
streaming XML Signature verification code will not report an error when trying
to validate the signature.
Please note that the "in-memory" (DOM) API for XML Signature is not affected by this issue, nor is the JSR-105 API. Also, web service stacks that use the streaming functionality of Apache Santuario (such as Apache CXF/WSS4J) are also not affected by this vulnerability.