Homepage

Cryptographic Issues The advisory has been revoked - it doesn't affect any version of package libxml-security-java  (opens in a new tab)

Threat Intelligence

EPSS
5.93% (93rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1404-LIBXMLSECURITYJAVA-637099
  • published20 Aug 2013
  • disclosed20 Aug 2013
Report a new vulnerability Found a mistake?

Introduced: 20 Aug 2013

CVE-2013-2172  (opens in a new tab)
CWE-310  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:14.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml-security-java package and not the libxml-security-java package as distributed by Ubuntu.

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."

References