Summary
It was discovered that Apache XML Security for Java incorrectly passed a
configuration property when creating specific key elements. This allows an
attacker to abuse an XPath Transform to extract sensitive information.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | libxml-security-java | 2.0.10-2~18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | libxml-security-java | 2.0.10-2+deb11u1build0.20.04.1 |
Vulnerabilities 1
-
High 7.5
Bypass of the secureValidation property
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abus…
References
-
report
https://ubuntu.com/security/CVE-2021-40690