PT-2019-4439 · Apache+1 · Apache Santuario Xml Security For Java+1
Published
2019-08-23
·
Updated
2024-06-15
·
CVE-2019-12400
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Santuario XML Security for Java versions 2.0.3 through 2.1.3
Description
The issue is related to a caching mechanism introduced in version 2.0.3 of Apache Santuario XML Security for Java, which can lead to potential security flaws when validating signed documents. This is due to the possibility of untrusted code registering a malicious implementation with the thread context class loader, which might be cached and re-used by the software. The vulnerability is associated with insufficient input validation in the DOM analyzer of DocumentBuilders, allowing an attacker to gain unauthorized access to protected information.
Recommendations
For Apache Santuario XML Security for Java versions 2.0.3 through 2.1.3, update to version 2.1.4 or later to resolve the issue.
For versions prior to 2.1.4, consider disabling the caching mechanism for DocumentBuilders as a temporary workaround until a patch is available.
At the moment, there is no other information about additional mitigation measures for this vulnerability.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Santuario Xml Security For Java
Debian