libxml-security-java

4 results · Clear filters · Feed

• Medium 6.5
  CVE-2023-44483

  Apache Santuario: Private Key disclosure in debug-log output

  All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level i…

  Apache Software Foundation Apache Santuario org.apache.santuario:xmlsec libxml-security-java Debian Ubuntu Maven
  Oct 20, 2023
• Medium 5.5
  CVE-2019-12400

  Improper input validation in Apache Santuario XML Security for Java

  In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread…

  Apache Apache Santuario - XML Security for Java org.apache.santuario:xmlsec libxml-security-java Debian Ubuntu Maven
  Aug 23, 2019
• Medium —
  CVE-2013-4517

  Improper Input Validation in Apache Santuario XML Security

  Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.

  org.apache.santuario:xmlsec libxml-security-java Debian Maven
  Jan 11, 2014
• Medium —
  CVE-2013-2172

  Inefficient Algorithmic Complexity in Apache Santuario XML Security

  jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify …

  org.apache.santuario:xmlsec libxml-security-java Debian Maven
  Aug 20, 2013