CVE-2013-2172 — Inefficient Algorithmic Complexity in Apache Santuario XML Security

Description

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libxml-security-java	1.5.5-2	—
Debian 13	libxml-security-java	1.5.5-2	—
Debian 12	libxml-security-java	1.5.5-2	—
Debian 7	libxml-security-java	1.4.5-1+deb7u1	DSA-3065-1
Debian 6.0	libxml-security-java	1.4.3-2+deb6u1	DLA-85-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Platform 5	xml-security	1.5.1-3_patch01.ep5.el5	RHSA-2013:1219
Red Hat JBoss EAP 6	apache-commons-beanutils	1.8.3-12.redhat_3.2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	apache-commons-daemon-jsvc-eap6	1:1.0.15-2.redhat_2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	apache-cxf	2.6.8-8.redhat_7.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	cxf-xjc-dv +3	2.6.0-2.redhat_4.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	hibernate4 +4	4.2.0-7.SP1_redhat_1.ep6.el6	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	hornetq	2.3.5-2.Final_redhat_2.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	hornetq-native +1	2.3.5-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	httpd +3	2.2.22-25.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	infinispan +4	5.2.7-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	ironjacamar +9	1.0.19-1.Final_redhat_2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jaxbintros	1.0.2-16.GA_redhat_6.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-aesh	0.33.7-2.redhat_2.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-as-console	1.5.6-2.Final_redhat_2.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-as-ee +56	7.2.1-5.Final_redhat_10.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-ejb-client	1.0.23-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-hal	1.5.7-1.Final_redhat_1.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-invocation	1.1.2-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-jsp-api_2.2_spec	1.0.1-6.Final_redhat_2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-logmanager	1.4.3-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-marshalling	1.3.18-1.GA_redhat_1.1.ep6.el6	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-modules	1.2.2-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-remote-naming	1.0.7-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-security-negotiation	2.2.5-2.Final_redhat_2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-stdio	1.0.2-1.GA_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossas-core +1	7.2.1-6.Final_redhat_10.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossas-javadocs	7.2.1-2.Final_redhat_10.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossas-modules-eap	7.2.1-9.Final_redhat_10.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossts	1:4.17.7-4.Final_redhat_4.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossweb	7.2.2-1.Final_redhat_1.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossws-cxf	4.1.4-7.Final_redhat_7.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossws-spi +1	2.1.3-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jcip-annotations-eap6	1.0-4.redhat_4.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jgroups	1:3.2.10-1.Final_redhat_2.2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	log4j-jboss-logmanager	1.0.2-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	mod_ssl	1:2.2.22-25.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	netty	3.6.6-2.Final_redhat_1.1.ep6.el6	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	opensaml	2.5.1-2.redhat_2.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	openws	1.4.2-10.redhat_4.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	picketbox	4.0.17-3.SP2_redhat_2.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	picketlink-federation	2.1.6.3-2.Final_redhat_2.2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	wss4j	1.6.10-1.redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	xml-security	1.5.5-1.redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 5	xml-security	1.5.1-3_patch01.ep5.el4	RHSA-2013:1217

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.santuario:xmlsec	>= 1.4.0, < 1.4.8	1.4.8	GHSA-r237-w2w6-jq3p
Maven	org.apache.santuario:xmlsec	>= 1.5.0, < 1.5.5	1.5.5	GHSA-r237-w2w6-jq3p

Advisories 7

RHSA-2013:1207 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.1.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:1208 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.1.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:1217 Red Hat Security Advisory: xml-security security update Red Hat Security Advisories (RHSA) · May 15, 2026
RHSA-2013:1219 Red Hat Security Advisory: xml-security security update Red Hat Security Advisories (RHSA) · May 15, 2026
DLA-85-1 libxml-security-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
DSA-3065-1 libxml-security-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
WID-SEC-2022-1738 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2025

References

RHSA-2013:1219 vendor-advisory
54019 third-party-advisory
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
RHSA-2013:1218 vendor-advisory
http://santuario.apache.org/secadv.data/CVE-2013-2172.txt.asc
RHSA-2013:1209 vendor-advisory
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list
USN-2028-1 vendor-advisory
RHSA-2013:1217 vendor-advisory
RHSA-2013:1437 vendor-advisory
http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java?r1=1353876&r2=1493772&pathrev=1493772&diff_format=h
RHSA-2013:1207 vendor-advisory
RHSA-2013:1375 vendor-advisory
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
RHSA-2014:0212 vendor-advisory
RHSA-2013:1853 vendor-advisory
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list
RHSA-2013:1208 vendor-advisory
RHSA-2013:1220 vendor-advisory
60846 vdb-entry
94651 vdb-entry
DSA-3065 vendor-advisory
[santuario-commits] 20190823 svn commit: r1049214 - in /websites/production/santuario/content: cache/main.pageCache download.html index.html javaindex.html javareleasenotes.html secadv.data/CVE-2019-12400.asc secadv.html mailing-list
[santuario-commits] 20210917 svn commit: r1076843 - in /websites/production/santuario/content: cache/main.pageCache index.html javaindex.html secadv.data/CVE-2021-40690.txt.asc secadv.html mailing-list