Inefficient Algorithmic Complexity in Apache Santuario XML Security

MEDIO 4.3CVE-2013-2172 · GHSA-r237-w2w6-jq3p · Published 20/08/2013 · updated 16/06/2026

En resumen

CVE-2013-2172 es una vulnerabilidad MEDIO (CVSS 4.3) que afecta a org.apache.santuario:xmlsec, santuario xml security for java (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 5.9%, mayor que el 93.3% de las vulnerabilidades.
Solución: actualizar a 1.4.8, 1.5.5 o posterior.

Package	Affected versions	Patched versions
org.apache.santuario:xmlsec Maven	`≥ 1.4.0, < 1.4.8≥ 1.5.0, < 1.5.5`	`1.4.81.5.5`
santuario xml security for java apache	`= 1.4.7= 1.5.0= 1.5.1= 1.5.2= 1.5.3= 1.5.4`	No fix yet

Description

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."

NVD description

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."

References

Más vulnerabilidades de org.apache.santuario:xmlsec

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free