Skip to content
OpenAdvisories
Unscored RHSA-2009:1428 1 CVE

Red Hat Security Advisory: xmlsec1 security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 40

ReleasePackageFixed in
Red Hat · RHEL 4 enterprise_linux:4::as xmlsec1 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::as xmlsec1-debuginfo 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::as xmlsec1-devel 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::as xmlsec1-openssl 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::as xmlsec1-openssl-devel 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::desktop xmlsec1 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::desktop xmlsec1-debuginfo 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::desktop xmlsec1-devel 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::desktop xmlsec1-openssl 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::desktop xmlsec1-openssl-devel 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::es xmlsec1 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::es xmlsec1-debuginfo 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::es xmlsec1-devel 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::es xmlsec1-openssl 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::es xmlsec1-openssl-devel 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::ws xmlsec1 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::ws xmlsec1-debuginfo 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::ws xmlsec1-devel 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::ws xmlsec1-openssl 0:1.2.6-3.1
Red Hat · RHEL 4 enterprise_linux:4::ws xmlsec1-openssl-devel 0:1.2.6-3.1
Red Hat · RHEL 5 enterprise_linux:5::client xmlsec1 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::client xmlsec1-debuginfo 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::client xmlsec1-gnutls 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::client xmlsec1-nss 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::client xmlsec1-openssl 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::client_workstation xmlsec1 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::client_workstation xmlsec1-debuginfo 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::client_workstation xmlsec1-devel 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::client_workstation xmlsec1-gnutls-devel 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::client_workstation xmlsec1-nss-devel 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::client_workstation xmlsec1-openssl-devel 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::server xmlsec1 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::server xmlsec1-debuginfo 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::server xmlsec1-devel 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::server xmlsec1-gnutls 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::server xmlsec1-gnutls-devel 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::server xmlsec1-nss 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::server xmlsec1-nss-devel 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::server xmlsec1-openssl 0:1.2.9-8.1.1
Red Hat · RHEL 5 enterprise_linux:5::server xmlsec1-openssl-devel 0:1.2.9-8.1.1

Vulnerabilities 1

  • Medium —
    CVE-2009-0217

    Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation

    The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server…

    mono org.apache.santuario:xmlsec xml-security-c xmlsec1 Debian Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    http://www.w3.org/TR/xmldsig-core/
  • article
    http://tools.ietf.org/html/rfc2104
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=511915
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1428.json
  • report
    https://access.redhat.com/security/cve/CVE-2009-0217
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-0217
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-0217