CVE-2013-2172

Published: Aug 20, 2013Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."

Affected (6)

Products: Apache: Santuario Xml Security For Java

1 product

Santuario Xml Security For Java

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Apache Santuario Xml Security For Java	Version 1.4.7
Apache Santuario Xml Security For Java	Version 1.5.0
Apache Santuario Xml Security For Java	Version 1.5.1
Apache Santuario Xml Security For Java	Version 1.5.2
Apache Santuario Xml Security For Java	Version 1.5.3
Apache Santuario Xml Security For Java	Version 1.5.4

Related CWEs

References (48)

http://rhn.redhat.com/errata/RHSA-2013-1207.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1208.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1209.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1217.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1218.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1219.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1220.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1375.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1437.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1853.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0212.html

Source: secalert@redhat.com

http://santuario.apache.org/secadv.data/CVE-2013-2172.txt.asc

Source: secalert@redhat.com

Vendor Advisory

http://seclists.org/fulldisclosure/2014/Dec/23

Source: secalert@redhat.com

http://secunia.com/advisories/54019

Source: secalert@redhat.com

Vendor Advisory

http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java?r1=1353876&r2=1493772&pathrev=1493772&diff_format=h

Source: secalert@redhat.com

Patch

http://www.debian.org/security/2014/dsa-3065

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Source: secalert@redhat.com

http://www.osvdb.org/94651

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/534161/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/60846

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2028-1

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Source: secalert@redhat.com

https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1207.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1208.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1209.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1217.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1218.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1219.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1220.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1375.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1437.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1853.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0212.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://santuario.apache.org/secadv.data/CVE-2013-2172.txt.asc

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://seclists.org/fulldisclosure/2014/Dec/23

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/54019

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java?r1=1353876&r2=1493772&pathrev=1493772&diff_format=h

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.debian.org/security/2014/dsa-3065

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/94651

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/534161/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/60846

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2028-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.