Search CVE reports
1 – 7 of 7 results
CVE-2023-44483
Medium priorityAll versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature...
1 affected packages
libxml-security-java
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| libxml-security-java | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
CVE-2021-40690
Medium prioritySome fixes available 2 of 5
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element....
1 affected packages
libxml-security-java
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| libxml-security-java | Not affected | Not affected | Fixed | Fixed | Vulnerable |
CVE-2019-12400
Medium priorityIn version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious...
1 affected packages
libxml-security-java
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| libxml-security-java | Not affected | Not affected | Vulnerable | Vulnerable | Needs evaluation |
CVE-2014-8152
Medium priorityApache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
1 affected packages
libxml-security-java
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| libxml-security-java | — | — | — | — | — |
CVE-2013-4517
Low priorityApache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.
1 affected packages
libxml-security-java
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| libxml-security-java | — | Not affected | Not affected | Not affected | Not affected |
CVE-2013-2172
Medium priorityjcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using...
1 affected packages
libxml-security-java
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| libxml-security-java | — | — | — | — | — |
CVE-2009-0217
Medium prioritySome fixes available 11 of 23
The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and...
7 affected packages
libreoffice, libxml-security-java, mono, openjdk-6, openoffice.org...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| libreoffice | — | — | — | — | — |
| libxml-security-java | — | — | — | — | — |
| mono | — | — | — | — | — |
| openjdk-6 | — | — | — | — | — |
| openoffice.org | — | — | — | — | — |
| xml-security-c | — | — | — | — | — |
| xmlsec1 | — | — | — | — | — |