Description
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Santuario | XML Security for Java – < 2.2.3,2.1.7 | 2.2.3,2.1.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxml-security-java | 2.1.7-1 | — |
| Debian 13 | libxml-security-java | 2.1.7-1 | — |
| Debian 12 | libxml-security-java | 2.1.7-1 | — |
| Debian 11 | libxml-security-java | 2.0.10-2+deb11u1 | DSA-5010-1 |
| Debian 10 | libxml-security-java | 2.0.10-2+deb10u1 | DSA-5010-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | libxml-security-java | 1.5.8-2+deb9u1 | DLA-2767-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libxml-security-java | 2.0.10-2+deb11u1build0.20.04.1 | USN-5525-1 |
| Ubuntu 18.04 LTS | libxml-security-java | 2.0.10-2~18.04.1 | USN-5525-1 |
| Ubuntu 16.04 LTS | libxml-security-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 15.0.4-1.redhat_00001.1.el7sso | RHSA-2022:0152, RHSA-2022:0151 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-activemq-artemis +15 | 1.5.5.016-1.redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-artemis-native +1 | 1:1.5.5.016-1.redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-xnio-base | 3.5.11-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jsoup | 1.14.2-1.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-14.SP13_redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.10-2.GA_redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-woodstox-core | 5.0.3-2.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xml-security | 2.0.10-2.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.3.12-1.redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.3-1.Final_redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-jakarta-el | 3.0.3-3.redhat_00007.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.43-1.Final_redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-10.Final_redhat_00011.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-jsoup | 1.14.2-1.redhat_00002.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.11.5-1.Final_redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.41-1.SP1_redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.10-2.GA_redhat_00003.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.10.15-1.Final_redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.10-2.GA_redhat_00003.1.el7eap | RHSA-2021:5150 |
| Red Hat JBoss EAP 7 | eap7-wss4j +6 | 2.2.7-1.redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-xml-security | 2.1.7-1.redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xml-security | 2.1.7-1.1 | openSUSE-SU-2024:11693-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.santuario:xmlsec | >= 2.2.0, < 2.2.3 | 2.2.3 | GHSA-j8wc-gxx9-82hx |
| Maven | org.apache.santuario:xmlsec | < 2.1.7 | 2.1.7 | GHSA-j8wc-gxx9-82hx |
Advisories 19
- RHSA-2025:4226 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2022:0152 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0151 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:5151 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:5150 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:5149 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2022-0607 Red Hat FUSE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
- USN-5525-1 libxml-security-java vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5010-1 libxml-security-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2767-1 libxml-security-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11693-1 xml-security-2.1.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-1738 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2025
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2022-0771 Apache XML-Security for Java: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Apr 27, 2025
- WID-SEC-2024-2180 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
- WID-SEC-2023-2993 Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence and Atlassian Jira Software: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 12, 2023
- WID-SEC-2023-2676 Oracle Enterprise Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-1815 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1018 Oracle Enterprise Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
References
- https://lists.apache.org/thread.html/r8848751b6a5dd78cc9e99d627e74fecfaffdfa1bb615dce827aad633%40%3Cdev.santuario.apache.org%3E
- [tomee-commits] 20210922 [tomee] 02/02: Update xmlsec to 2.2.3 to mitigate CVE-2021-40690 mailing-list
- [tomee-commits] 20210923 [jira] [Resolved] (TOMEE-3798) TomEE (8.0.8) is affected by CVE-2021-40690 vulnerability mailing-list
- [tomee-commits] 20210923 [jira] [Created] (TOMEE-3798) TomEE (8.0.8) is affected by CVE-2021-40690 vulnerability mailing-list
- [tomee-commits] 20210923 [jira] [Assigned] (TOMEE-3798) TomEE (8.0.8) is affected by CVE-2021-40690 vulnerability mailing-list
- [tomee-commits] 20210923 [jira] [Updated] (TOMEE-3798) TomEE (8.0.8) is affected by CVE-2021-40690 vulnerability mailing-list
- [poi-user] 20210923 Re: CVE-2021-40690 on xmlsec jar mailing-list
- [debian-lts-announce] 20210927 [SECURITY] [DLA 2767-1] libxml-security-java security update mailing-list
- [cxf-issues] 20211027 [jira] [Created] (CXF-8613) High Security issues reported with Apache Santuario library bundled in CXF 3.4.4 mailing-list
- [tomee-commits] 20211028 [jira] [Updated] (TOMEE-3798) TomEE (8.0.8) is affected by CVE-2021-40690 vulnerability mailing-list
- DSA-5010 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.netapp.com/advisory/ntap-20230818-0002/