PT-2023-6589 · Apache+1 · Apache Santuario Xml Security For Java+1

Max Fichtelmann · Published 2023-10-19 · Updated 2025-10-11 · CVE-2023-44483

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Santuario - XML Security for Java versions prior to 2.2.6 Apache Santuario - XML Security for Java versions prior to 2.3.4 Apache Santuario - XML Security for Java versions prior to 3.0.3

Description The issue is related to the disclosure of information through log files. When using the JSR 105 API and generating an XML Signature with debug level logging enabled, a private key may be disclosed in log files.

Recommendations Upgrade to version 2.2.6, which fixes this issue. Upgrade to version 2.3.4, which fixes this issue. Upgrade to version 3.0.3, which fixes this issue.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2023-07354

CVE-2023-44483

GHSA-XFRJ-6VVC-3XM2

OESA-2025-2380

OESA-2025-2381

OESA-2025-2382

OESA-2025-2383

OESA-2025-2384

OESA-2025-2385

RHSA-2024:0710

RHSA-2024:0711

RHSA-2024:0712

RHSA-2024:0798

RHSA-2024:0799

RHSA-2024:0800

Affected Products

Apache Santuario Xml Security For Java

Debian

References · 33

• https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2382 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-44483 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2383 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2385 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-44483 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44483 · Security Note
• https://osv.dev/vulnerability/OESA-2025-2384 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xfrj-6vvc-3xm2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/libxml-security-java · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2380 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-44483 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-44483 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-44483 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-44483 · Vendor Advisory