| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.santuario:xmlsec | ≥ 1.4.0, < 1.4.8≥ 1.5.0, < 1.5.3 | 1.4.81.5.3 |
| jdk | = 1.6.0= 1.7.0≤ 1.6.0≤ 1.7.0 | |
| jre | = 1.6.0= 1.7.0≤ 1.6.0≤ 1.7.0 | |
| jrockit | = r27.7.1= r27.7.2= r27.7.3= r27.7.4= r27.7.5= r28.0.0= r28.0.1= r28.0.2= r28.1.0= r28.1.1= r28.1.3= r28.1.4= r28.1.5= r28.2.2= r28.2.3= r28.2.4= r28.2.5= r28.2.6≤ r27.7.6≤ r28.2.8 | |
| jdk | = 1.6.0 | |
| jre | = 1.6.0 |
Affected versions of xmlsec are subject to a denial of service vulnerability. Should a user check the signature of a message larger than 512 MB, the method expandSize(int newPos) of class org.apache.xml.security.utils.UnsyncByteArrayOutputStream goes in an endless loop. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free