Description
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.santuario:xmlsec | >= 2.0.0, < 2.0.3 | 2.0.3 | GHSA-w7cq-j9p9-hm3m |
References
- apache-santuario-cve20148152-sec-bypass(99993) vdb-entry
- http://santuario.apache.org/secadv.data/CVE-2014-8152.txt.asc
- 72115 vdb-entry
- 1031556 vdb-entry
- [oss-security] 20150119 New Apache Santuario security advisory CVE-2014-8152 mailing-list
- [santuario-commits] 20190823 svn commit: r1049214 - in /websites/production/santuario/content: cache/main.pageCache download.html index.html javaindex.html javareleasenotes.html secadv.data/CVE-2019-12400.asc secadv.html mailing-list
- [santuario-commits] 20210917 svn commit: r1076843 - in /websites/production/santuario/content: cache/main.pageCache index.html javaindex.html secadv.data/CVE-2021-40690.txt.asc secadv.html mailing-list