PT-2013-1365 · Apache · Apache Santuario Xml Security For Java

James Forshaw · Published 2013-08-20 · Updated 2023-04-18 · CVE-2013-2172

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Santuario XML Security for Java versions 1.4.x through 1.4.7 Apache Santuario XML Security for Java versions 1.5.x through 1.5.4

Description The issue allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak canonicalization algorithm to apply to the SignedInfo part of the Signature. This is related to errors in data encryption. Exploitation of the issue may allow a remote attacker to substitute an XML signature.

Recommendations For Apache Santuario XML Security for Java versions 1.4.x through 1.4.7, update to version 1.4.8 or later. For Apache Santuario XML Security for Java versions 1.5.x through 1.5.4, update to version 1.5.5 or later. As a temporary workaround, consider restricting the use of the CanonicalizationMethod parameter to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-407

CWE-310

Related Identifiers

BDU:2022-06636

CVE-2013-2172

DLA-85-1

DSA-3065-1

GHSA-R237-W2W6-JQ3P

MGASA-2014-0002

RHSA-2013:1207

RHSA-2013:1208

RHSA-2013:1217

RHSA-2013:1219

USN-2028-1

Affected Products

Apache Santuario Xml Security For Java

References · 48

• https://ubuntu.com/security/CVE-2013-2172 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0002 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-2172 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1853.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2028-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1217.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1219.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2172 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1437.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2172 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1220.html · Vendor Advisory
• http://ubuntu.com/usn/USN-2028-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1375.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1209.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-2172 · Vendor Advisory