PT-2021-7970 · Apache+4 · Apache Santuario Xml Security For Java+5

Published 2021-09-19 · Updated 2024-06-15 · CVE-2021-40690

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Santuario - XML Security for Java versions prior to 2.2.3 and 2.1.7

Description The issue is related to the secureValidation property not being passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

Recommendations For Apache Santuario - XML Security for Java versions prior to 2.2.3, upgrade to version 2.2.3 or later. For Apache Santuario - XML Security for Java versions prior to 2.1.7, upgrade to version 2.1.7 or later. As a temporary workaround, consider restricting access to the RetrievalMethod element to minimize the risk of exploitation. Avoid using the secureValidation property in the affected KeyInfo creation until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-07907

CVE-2021-40690

DLA-2767-1

DSA-5010-1

GHSA-J8WC-GXX9-82HX

OPENSUSE-SU-2024:11693-1

RHSA-2021:5149

RHSA-2021:5150

RHSA-2021:5151

RHSA-2022:0151

RHSA-2022:0152

RHSA-2025:4226

USN-5525-1

Affected Products

Apache Santuario Xml Security For Java

Astra Linux

Bitbucket

Jira

Linuxmint

Ubuntu

References · 46

• 🔥 https://lists.apache.org/thread.html/raf352f95c19c0c4051af3180752cb69acbea88d0d066ab176c6170e8@%3Cuser.poi.apache.org%3E · Exploit
• 🔥 https://lists.apache.org/thread.html/r3b3f5ba9b0de8c9c125077b71af06026d344a709a8ba67db81ee9faa@%3Ccommits.tomee.apache.org%3E · Exploit
• https://cve.org/CVERecord?id=CVE-2021-40690 · Security Note
• https://osv.dev/vulnerability/DLA-2767-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5525-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11693-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-40690 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40690 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-40690 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40690 · Security Note
• https://lists.apache.org/thread.html/r8848751b6a5dd78cc9e99d627e74fecfaffdfa1bb615dce827aad633%40%3Cdev.santuario.apache.org%3E · Patch
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40690 · Security Note
• https://ubuntu.com/security/notices/USN-5525-1 · Vendor Advisory