Security Features Affecting org.apache.santuario:xmlsec package, versions [2.0.0,2.0.2]
Threat Intelligence
EPSS
0.22% (62nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHESANTUARIO-30032
- published 20 Jan 2015
- disclosed 20 Jan 2015
- credit Jaime Pallarés Rel
Introduced: 20 Jan 2015
CVE-2014-8152 Open this link in a new tabOverview
org.apache.santuario:xmlsec
For certain XML documents, it is possible to modify the document and the
streaming XML Signature verification code will not report an error when trying
to validate the signature.
Please note that the "in-memory" (DOM) API for XML Signature is not affected by this issue, nor is the JSR-105 API. Also, web service stacks that use the streaming functionality of Apache Santuario (such as Apache CXF/WSS4J) are also not affected by this vulnerability.
References
CVSS Scores
version 3.1