PT-2023-6589 · Apache+1 · Apache Santuario Xml Security For Java+1

Max Fichtelmann · Publicado 2023-10-19 · Atualizado 2025-10-11 · CVE-2023-44483

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Santuario - XML Security for Java versions prior to 2.2.6 Apache Santuario - XML Security for Java versions prior to 2.3.4 Apache Santuario - XML Security for Java versions prior to 3.0.3

Description The issue is related to the disclosure of information through log files. When using the JSR 105 API and generating an XML Signature with debug level logging enabled, a private key may be disclosed in log files.

Recommendations Upgrade to version 2.2.6, which fixes this issue. Upgrade to version 2.3.4, which fixes this issue. Upgrade to version 3.0.3, which fixes this issue.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

BDU:2023-07354

CVE-2023-44483

GHSA-XFRJ-6VVC-3XM2

OESA-2025-2380

OESA-2025-2381

OESA-2025-2382

OESA-2025-2383

OESA-2025-2384

OESA-2025-2385

RHSA-2024:0710

RHSA-2024:0711

RHSA-2024:0712

RHSA-2024:0798

RHSA-2024:0799

RHSA-2024:0800

Produtos afetados

Apache Santuario Xml Security For Java

Debian

Referências · 33

• https://github.com/apache/santuario-java · Nota
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2382 · Nota
• https://twitter.com/Esparta6108713/status/1755779500598853677 · Publicação no Twitter
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2383 · Nota
• https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1715344176571654380 · Publicação no Twitter
• https://t.me/cibsecurity/72687 · Publicação no Telegram
• https://santuario.apache.org/secadv.data/CVE-2023-44483.txt.asc?version=1&modificationDate=1697782758000&api=v2 · Nota
• https://osv.dev/vulnerability/OESA-2025-2382 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-44483 · Aviso do Fabricante
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2385 · Nota
• https://osv.dev/vulnerability/OESA-2025-2383 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2025-2385 · Aviso do Fabricante
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2380 · Nota
• https://security-tracker.debian.org/tracker/CVE-2023-44483 · Aviso do Fabricante