Inefficient Algorithmic Complexity in Apache Santuario XML Security

CVE-2013-2172 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
—
Source code
Browse source ↗
Published (advisory)
2022-05-13 01:05:56 UTC
Updated
2024-03-05 18:21:59 UTC
GitHub reviewed
2022-07-08 19:08:41 UTC
NVD published
2013-08-20

EPSS Score

Score Percentile
5.39% 89.68%

CVSS Scores

No CVSS scores in this advisory.

Identifiers

Type Value
GHSA GHSA-r237-w2w6-jq3p ↗
CVE CVE-2013-2172 ↗

CWEs

CWE id Name
CWE-407 Inefficient Algorithmic Complexity

Credits

  • MarkLee131 (analyst)

Affected packages (2)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
maven org.apache.santuario:xmlsec >= 1.4.0, < 1.4.8 1.4.8 —
maven org.apache.santuario:xmlsec >= 1.5.0, < 1.5.5 1.5.5 —

References

cvelogic Threat Intelligence