Description
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache | Apache Santuario - XML Security for Java | All 2.0.x releases from 2.0.3, all 2.1.x releases before 2.1.4. | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxml-security-java | 2.1.7-1 | — |
| Debian 13 | libxml-security-java | 2.1.7-1 | — |
| Debian 12 | libxml-security-java | 2.1.7-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libxml-security-java | No fix yet | — |
| Ubuntu 18.04 LTS | libxml-security-java | No fix yet | — |
| Ubuntu 16.04 LTS | libxml-security-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.9.0-2.redhat_00009.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-beanutils | 1.9.4-1.redhat_00002.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-glassfish-el +1 | 3.0.1-4.b08_redhat_00003.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-7.SP3_redhat_00005.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.15-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.3.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.10.2-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jaegertracing-jaeger-client-java +2 | 0.34.1-1.redhat_00002.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.28-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.17-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-8.Final_redhat_00009.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-picketlink-bindings +1 | 2.5.5-23.SP12_redhat_00012.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-stax2-api | 4.2.0-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-sun-istack-commons +2 | 3.0.10-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-thrift | 0.13.0-1.redhat_00002.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-txw2 +8 | 2.3.3-4.b02_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.7-4.GA_redhat_00004.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.7-4.GA_redhat_00004.1.el7eap | RHSA-2020:0805 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl +2 | 1.0.9-2.SP03_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.9-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-woodstox-core | 6.0.3-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-xml-security | 2.1.4-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xml-security | 2.1.7-1.1 | openSUSE-SU-2024:11693-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.santuario:xmlsec | >= 2.0.3, < 2.1.4 | 2.1.4 | GHSA-4q98-wr72-h35w |
Advisories 4
- RHSA-2020:0805 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0806 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0804 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- openSUSE-SU-2024:11693-1 xml-security-2.1.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [santuario-dev] 20190905 Re: [CVE-2019-12400] Apache Santuario potentially loads XML parsing code from an untrusted source mailing-list
- [santuario-dev] 20190906 Re: [CVE-2019-12400] Apache Santuario potentially loads XML parsing code from an untrusted source mailing-list
- RHSA-2020:0806 vendor-advisory
- RHSA-2020:0811 vendor-advisory
- RHSA-2020:0804 vendor-advisory
- RHSA-2020:0805 vendor-advisory
- [tomee-commits] 20200324 [jira] [Created] (TOMEE-2791) TomEE plus(7.0.7) is affected by CVE-2019-12400 vulnerability mailing-list
- [tomee-commits] 20200720 [jira] [Created] (TOMEE-2885) Update Apache XML Security for Java to mitigate CVE-2019-12400 mailing-list
- [tomee-commits] 20200720 [jira] [Assigned] (TOMEE-2885) Update Apache XML Security for Java to mitigate CVE-2019-12400 mailing-list
- [tomee-commits] 20200720 [jira] [Commented] (TOMEE-2885) Update Apache XML Security for Java to mitigate CVE-2019-12400 mailing-list
- [santuario-commits] 20210917 svn commit: r1076843 - in /websites/production/santuario/content: cache/main.pageCache index.html javaindex.html secadv.data/CVE-2021-40690.txt.asc secadv.html mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- http://santuario.apache.org/secadv.data/CVE-2019-12400.asc?version=1&modificationDate=1566573083000&api=v2
- https://security.netapp.com/advisory/ntap-20190910-0003/