PT-2013-1365 · Apache · Apache Santuario Xml Security For Java

James Forshaw · Publicado 2013-08-20 · Atualizado 2023-04-18 · CVE-2013-2172

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Santuario XML Security for Java versions 1.4.x through 1.4.7 Apache Santuario XML Security for Java versions 1.5.x through 1.5.4

Description The issue allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak canonicalization algorithm to apply to the SignedInfo part of the Signature. This is related to errors in data encryption. Exploitation of the issue may allow a remote attacker to substitute an XML signature.

Recommendations For Apache Santuario XML Security for Java versions 1.4.x through 1.4.7, update to version 1.4.8 or later. For Apache Santuario XML Security for Java versions 1.5.x through 1.5.4, update to version 1.5.5 or later. As a temporary workaround, consider restricting the use of the CanonicalizationMethod parameter to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-407

CWE-310

Identificadores relacionados

BDU:2022-06636

CVE-2013-2172

DLA-85-1

DSA-3065-1

GHSA-R237-W2W6-JQ3P

MGASA-2014-0002

RHSA-2013:1207

RHSA-2013:1208

RHSA-2013:1217

RHSA-2013:1219

USN-2028-1

Produtos afetados

Apache Santuario Xml Security For Java

Referências · 48

• https://github.com/apache/santuario-java/commit/8e8f8bf92a43608d7d5f9e357fae19244454a61f · Nota
• https://github.com/apache/santuario-java/commit/25e0e11493b061749f778030036cb5c406b34590 · Nota
• https://github.com/apache/santuario-java · Nota
• https://ubuntu.com/security/CVE-2013-2172 · Aviso do Fabricante
• https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3@%3Ccommits.santuario.apache.org%3E · Nota
• https://osv.dev/vulnerability/MGASA-2014-0002 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2013-2172 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2013-1853.html · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2028-1 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2013-1217.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2013-1219.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-2172 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2013-1437.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2172 · Aviso do Fabricante
• http://securityfocus.com/bid/60846 · Nota