Description
The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mono | 2.4.2.3+dfsg-1 | — |
| Debian 14 | xml-security-c | 1.4.0-4 | — |
| Debian 14 | xmlsec1 | 1.2.12-1 | — |
| Debian 13 | mono | 2.4.2.3+dfsg-1 | — |
| Debian 13 | xml-security-c | 1.4.0-4 | — |
| Debian 13 | xmlsec1 | 1.2.12-1 | — |
| Debian 12 | mono | 2.4.2.3+dfsg-1 | — |
| Debian 12 | xml-security-c | 1.4.0-4 | — |
| Debian 12 | xmlsec1 | 1.2.12-1 | — |
| Debian 6.0 | openoffice.org | 1:3.1.1-15+squeeze1 | DTSA-205-1 |
| Debian 5.0 | openoffice.org | 1:2.4.1+dfsg-1+lenny6 | DSA-1995-1 |
| Debian 5.0 | xml-security-c | 1.4.0-3+lenny2 | DSA-1849-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | openoffice.org | 2.0.4.dfsg.2-7etch9 | DSA-1995-1 |
| Debian 4.0 | xml-security-c | 1.2.1-3+etch1 | DSA-1849-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.7-1jpp.2.el5 | RHSA-2009:1694 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.2.b09.el5 | RHSA-2009:1201 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.15-1jpp.1.el5 | RHSA-2009:1200 |
| RHEL 5 | xmlsec1 +7 | 1.2.9-8.1.1 | RHSA-2009:1428 |
| RHEL 4 | java-1.6.0-ibm +6 | 1:1.6.0.7-1jpp.3.el4 | RHSA-2009:1694 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.15-1jpp.1.el4 | RHSA-2009:1200 |
| RHEL 4 | xmlsec1 +3 | 1.2.6-3.1 | RHSA-2009:1428 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.7-1jpp.2.el5 | RHSA-2010:0043 |
| Red Hat JBoss EAP 4 | glassfish-javamail | 1.4.2-0jpp.ep1.5.el4 | RHSA-2009:1637, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | glassfish-jaxb +1 | 2.1.4-1.12.patch03.ep1.el4 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | glassfish-jsf | 1.2_13-2.1.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | hibernate3 +1 | 1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.3.1-1.11.GA_CP02.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | hibernate3-entitymanager +1 | 3.3.2-2.5.GA_CP01.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jacorb | 2.3.0-1jpp.ep1.9.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jakarta-commons-logging-jboss | 1.1-9.ep1.el4 | RHSA-2009:1637, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jboss-aop | 1.5.5-3.CP04.2.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jboss-common | 1.2.1-0jpp.ep1.3.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jboss-messaging | 1.4.0-3.SP3_CP09.4.ep1.el4 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.3-3.SP1.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-1.ep1.14.el5 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jboss-seam2 +1 | 2.0.2.FP-1.ep1.18.el5 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jbossas +2 | 4.2.0-5.GA_CP08.5.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jbossas-4.3.0.GA_CP07-bin | 4.3.0-6.GA_CP07.4.ep1.el4 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jbossts | 1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-6.CP12.0jpp.ep1.2.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jbossws +1 | 2.0.1-4.SP2_CP07.2.ep1.el4 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jbossws-common | 1.0.0-2.GA_CP05.1.ep1.el4 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jbossws-framework | 2.0.1-1.GA_CP05.1.ep1.el4 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jcommon | 1.0.16-1.1.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jfreechart | 1.0.13-2.3.1.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jgroups | 1:2.4.7-1.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | quartz | 1.5.2-1jpp.patch01.ep1.4.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.2.0-6.GA_CP08.ep1.3.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | xerces-j2 | 2.7.1-9jpp.4.patch_02.1.ep1.el4 | RHSA-2009:1637, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | xml-security | 1.3.0-1.3.patch01.ep1.2.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.santuario:xmlsec | >= 1.4.0, < 1.4.3 | 1.4.3 | GHSA-8hfm-837h-hjg5 |
Advisories 13
- RHSA-2010:0043 Red Hat Security Advisory: Red Hat Network Satellite Server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1694 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1650 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP08 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1649 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP07 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1637 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP08 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1636 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP07 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1428 Red Hat Security Advisory: xmlsec1 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1201 Red Hat Security Advisory: java-1.6.0-openjdk security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1200 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-1849-1 xml-security-c - signature forgery Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1995-1 openoffice.org - several Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-205-1 openoffice.org - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2022-1738 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2025
References
- RHSA-2009:1428 vendor-advisory
- ADV-2009-3122 vdb-entry
- http://www.openoffice.org/security/cves/CVE-2009-0217.html
- https://issues.apache.org/bugzilla/show_bug.cgi?id=47526
- 60799 third-party-advisory
- GLSA-201408-19 vendor-advisory
- PK80596 vendor-advisory
- RHSA-2009:1200 vendor-advisory
- 35776 third-party-advisory
- 36162 third-party-advisory
- 36494 third-party-advisory
- ADV-2009-2543 vdb-entry
- 35858 third-party-advisory
- 38695 third-party-advisory
- 269208 vendor-advisory
- DSA-1995 vendor-advisory
- HPSBUX02476 vendor-advisory
- 35853 third-party-advisory
- RHSA-2009:1637 vendor-advisory
- RHSA-2009:1694 vendor-advisory
- 35852 third-party-advisory
- 35854 third-party-advisory
- 34461 third-party-advisory
- http://www.kb.cert.org/vuls/id/WDON-7TY529
- http://www.mono-project.com/Vulnerabilities
- 1020710 vendor-advisory
- USN-903-1 vendor-advisory
- 35671 vdb-entry
- https://issues.apache.org/bugzilla/show_bug.cgi?id=47527
- ADV-2010-0366 vdb-entry
- 55907 vdb-entry
- MDVSA-2009:209 vendor-advisory
- SUSE-SA:2010:017 vendor-advisory
- 38567 third-party-advisory
- FEDORA-2009-8329 vendor-advisory
- 263429 vendor-advisory
- http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161
- ADV-2009-1900 vdb-entry
- 1022561 vdb-entry
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
- 37671 third-party-advisory
- VU#466161 third-party-advisory
- 1022567 vdb-entry
- RHSA-2009:1636 vendor-advisory
- PK80627 vendor-advisory
- RHSA-2009:1649 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
- TA09-294A third-party-advisory
- ADV-2009-1909 vdb-entry
- ADV-2010-0635 vdb-entry
- http://svn.apache.org/viewvc?revision=794013&view=revision
- 38568 third-party-advisory
- 36180 third-party-advisory
- FEDORA-2009-8456 vendor-advisory
- http://www.w3.org/2008/06/xmldsigcore-errata.html#e03
- USN-826-1 vendor-advisory
- 37841 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1
- 35855 third-party-advisory