Read the docs
TI-2009-00202 Aliases CVE-2009-0217GHSA-8hfm-837h-hjg5

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as…

Priority LOW 32Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

Why it matters now

EPSS 0.06363 93rd percentileScored 2026-11-07
Fix Fixed org.apache.santuario:xmlsec (Maven): 1.4.3Red Hat: 9 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.santuario:xmlsec (Maven)1.4.0 to before 1.4.31.4.3Patch availableGHSA-8hfm-837h-hjg5
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.santuario:xmlsec (Maven) Vendor— Affected 1.4.0 to before 1.4.3 Fixed in 1.4.3 Patch available GHSA-8hfm-837h-hjg5

CPE configurations NVD · 93

CPEVersionsRoleVendor
cpe:2.3:a:ibm:websphere_application_server:6.0:*:*:*:*:*:*:*6.0VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.0.1:*:*:*:*:*:*:*6.0.0.1VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.0.2:*:*:*:*:*:*:*6.0.0.2VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.0.3:*:*:*:*:*:*:*6.0.0.3VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.1:*:*:*:*:*:*:*6.0.1VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.1.1:*:*:*:*:*:*:*6.0.1.1VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.1.2:*:*:*:*:*:*:*6.0.1.2VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.1.3:*:*:*:*:*:*:*6.0.1.3VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.1.5:*:*:*:*:*:*:*6.0.1.5VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.1.7:*:*:*:*:*:*:*6.0.1.7VulnerableIBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.0.1:*:*:*:*:*:*:* Versions 6.0.0.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.0.2:*:*:*:*:*:*:* Versions 6.0.0.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.0.3:*:*:*:*:*:*:* Versions 6.0.0.3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.1:*:*:*:*:*:*:* Versions 6.0.1.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.2:*:*:*:*:*:*:* Versions 6.0.1.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.3:*:*:*:*:*:*:* Versions 6.0.1.3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.5:*:*:*:*:*:*:* Versions 6.0.1.5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.7:*:*:*:*:*:*:* Versions 6.0.1.7 Vulnerable ·IBM
Show 83 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ibm:websphere_application_server:6.0.1.9:*:*:*:*:*:*:*6.0.1.9VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.1.11:*:*:*:*:*:*:*6.0.1.11VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.1.13:*:*:*:*:*:*:*6.0.1.13VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.1.15:*:*:*:*:*:*:*6.0.1.15VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.1.17:*:*:*:*:*:*:*6.0.1.17VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*6.0.2VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:fp17:*:*:*:*:*6.0.2VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.1:*:*:*:*:*:*:*6.0.2.1VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.2:*:*:*:*:*:*:*6.0.2.2VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.3:*:*:*:*:*:*:*6.0.2.3VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.10:*:*:*:*:*:*:*6.0.2.10VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.11:*:*:*:*:*:*:*6.0.2.11VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.12:*:*:*:*:*:*:*6.0.2.12VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.13:*:*:*:*:*:*:*6.0.2.13VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.14:*:*:*:*:*:*:*6.0.2.14VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.15:*:*:*:*:*:*:*6.0.2.15VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.16:*:*:*:*:*:*:*6.0.2.16VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.17:*:*:*:*:*:*:*6.0.2.17VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.18:*:*:*:*:*:*:*6.0.2.18VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.19:*:*:*:*:*:*:*6.0.2.19VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.20:*:*:*:*:*:*:*6.0.2.20VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.21:*:*:*:*:*:*:*6.0.2.21VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.22:*:*:*:*:*:*:*6.0.2.22VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.23:*:*:*:*:*:*:*6.0.2.23VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.24:*:*:*:*:*:*:*6.0.2.24VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.25:*:*:*:*:*:*:*6.0.2.25VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.28:*:*:*:*:*:*:*6.0.2.28VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.29:*:*:*:*:*:*:*6.0.2.29VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.30:*:*:*:*:*:*:*6.0.2.30VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.31:*:*:*:*:*:*:*6.0.2.31VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.32:*:*:*:*:*:*:*6.0.2.32VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.0.2.33:*:*:*:*:*:*:*6.0.2.33VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*6.1VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0:*:*:*:*:*:*:*6.1.0VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.0:*:*:*:*:*:*:*6.1.0.0VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.1:*:*:*:*:*:*:*6.1.0.1VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.2:*:*:*:*:*:*:*6.1.0.2VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.3:*:*:*:*:*:*:*6.1.0.3VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.4:*:*:*:*:*:*:*6.1.0.4VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.5:*:*:*:*:*:*:*6.1.0.5VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.6:*:*:*:*:*:*:*6.1.0.6VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.7:*:*:*:*:*:*:*6.1.0.7VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.8:*:*:*:*:*:*:*6.1.0.8VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.9:*:*:*:*:*:*:*6.1.0.9VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.10:*:*:*:*:*:*:*6.1.0.10VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.11:*:*:*:*:*:*:*6.1.0.11VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.12:*:*:*:*:*:*:*6.1.0.12VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.13:*:*:*:*:*:*:*6.1.0.13VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.14:*:*:*:*:*:*:*6.1.0.14VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.15:*:*:*:*:*:*:*6.1.0.15VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.16:*:*:*:*:*:*:*6.1.0.16VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.17:*:*:*:*:*:*:*6.1.0.17VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.18:*:*:*:*:*:*:*6.1.0.18VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.19:*:*:*:*:*:*:*6.1.0.19VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.20:*:*:*:*:*:*:*6.1.0.20VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.21:*:*:*:*:*:*:*6.1.0.21VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.22:*:*:*:*:*:*:*6.1.0.22VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:6.1.0.23:*:*:*:*:*:*:*6.1.0.23VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*7.0VulnerableIBM
cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*7.0.0.1VulnerableIBM
cpe:2.3:a:mono_project:mono:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableMono Project
cpe:2.3:a:mono_project:mono:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableMono Project
cpe:2.3:a:mono_project:mono:1.2.3:*:*:*:*:*:*:*1.2.3VulnerableMono Project
cpe:2.3:a:mono_project:mono:1.2.4:*:*:*:*:*:*:*1.2.4VulnerableMono Project
cpe:2.3:a:mono_project:mono:1.2.5:*:*:*:*:*:*:*1.2.5VulnerableMono Project
cpe:2.3:a:mono_project:mono:1.2.6:*:*:*:*:*:*:*1.2.6VulnerableMono Project
cpe:2.3:a:mono_project:mono:1.9:*:*:*:*:*:*:*1.9VulnerableMono Project
cpe:2.3:a:mono_project:mono:2.0:*:*:*:*:*:*:*2.0VulnerableMono Project
cpe:2.3:a:oracle:application_server:10.1.2.3:*:*:*:*:*:*:*10.1.2.3VulnerableOracle
cpe:2.3:a:oracle:application_server:10.1.3.4:*:*:*:*:*:*:*10.1.3.4VulnerableOracle
cpe:2.3:a:oracle:application_server:10.1.4.3im:*:*:*:*:*:*:*10.1.4.3imVulnerableOracle
cpe:2.3:a:oracle:bea_product_suite:8.1:sp6:*:*:*:*:*:*8.1 sp6VulnerableOracle
cpe:2.3:a:oracle:bea_product_suite:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
cpe:2.3:a:oracle:bea_product_suite:9.1:*:*:*:*:*:*:*9.1VulnerableOracle
cpe:2.3:a:oracle:bea_product_suite:9.2:mp3:*:*:*:*:*:*9.2 mp3VulnerableOracle
cpe:2.3:a:oracle:bea_product_suite:10.0:mp1:*:*:*:*:*:*10.0 mp1VulnerableOracle
cpe:2.3:a:oracle:bea_product_suite:10.3:*:*:*:*:*:*:*10.3VulnerableOracle
cpe:2.3:a:oracle:weblogic_server_component:8.1:sp6:*:*:*:*:*:*8.1 sp6VulnerableOracle
cpe:2.3:a:oracle:weblogic_server_component:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server_component:9.1:*:*:*:*:*:*:*9.1VulnerableOracle
cpe:2.3:a:oracle:weblogic_server_component:9.2:mp3:*:*:*:*:*:*9.2 mp3VulnerableOracle
cpe:2.3:a:oracle:weblogic_server_component:10.0:mp1:*:*:*:*:*:*10.0 mp1VulnerableOracle
cpe:2.3:a:oracle:weblogic_server_component:10.3:*:*:*:*:*:*:*10.3VulnerableOracle
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.9:*:*:*:*:*:*:* Versions 6.0.1.9 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.11:*:*:*:*:*:*:* Versions 6.0.1.11 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.13:*:*:*:*:*:*:* Versions 6.0.1.13 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.15:*:*:*:*:*:*:* Versions 6.0.1.15 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.17:*:*:*:*:*:*:* Versions 6.0.1.17 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:* Versions 6.0.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:fp17:*:*:*:*:* Versions 6.0.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.1:*:*:*:*:*:*:* Versions 6.0.2.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.2:*:*:*:*:*:*:* Versions 6.0.2.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.3:*:*:*:*:*:*:* Versions 6.0.2.3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.10:*:*:*:*:*:*:* Versions 6.0.2.10 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.11:*:*:*:*:*:*:* Versions 6.0.2.11 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.12:*:*:*:*:*:*:* Versions 6.0.2.12 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.13:*:*:*:*:*:*:* Versions 6.0.2.13 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.14:*:*:*:*:*:*:* Versions 6.0.2.14 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.15:*:*:*:*:*:*:* Versions 6.0.2.15 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.16:*:*:*:*:*:*:* Versions 6.0.2.16 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.17:*:*:*:*:*:*:* Versions 6.0.2.17 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.18:*:*:*:*:*:*:* Versions 6.0.2.18 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.19:*:*:*:*:*:*:* Versions 6.0.2.19 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.20:*:*:*:*:*:*:* Versions 6.0.2.20 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.21:*:*:*:*:*:*:* Versions 6.0.2.21 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.22:*:*:*:*:*:*:* Versions 6.0.2.22 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.23:*:*:*:*:*:*:* Versions 6.0.2.23 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.24:*:*:*:*:*:*:* Versions 6.0.2.24 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.25:*:*:*:*:*:*:* Versions 6.0.2.25 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.28:*:*:*:*:*:*:* Versions 6.0.2.28 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.29:*:*:*:*:*:*:* Versions 6.0.2.29 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.30:*:*:*:*:*:*:* Versions 6.0.2.30 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.31:*:*:*:*:*:*:* Versions 6.0.2.31 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.32:*:*:*:*:*:*:* Versions 6.0.2.32 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.33:*:*:*:*:*:*:* Versions 6.0.2.33 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0:*:*:*:*:*:*:* Versions 6.1.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.0:*:*:*:*:*:*:* Versions 6.1.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.1:*:*:*:*:*:*:* Versions 6.1.0.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.2:*:*:*:*:*:*:* Versions 6.1.0.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.3:*:*:*:*:*:*:* Versions 6.1.0.3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.4:*:*:*:*:*:*:* Versions 6.1.0.4 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.5:*:*:*:*:*:*:* Versions 6.1.0.5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.6:*:*:*:*:*:*:* Versions 6.1.0.6 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.7:*:*:*:*:*:*:* Versions 6.1.0.7 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.8:*:*:*:*:*:*:* Versions 6.1.0.8 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.9:*:*:*:*:*:*:* Versions 6.1.0.9 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.10:*:*:*:*:*:*:* Versions 6.1.0.10 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.11:*:*:*:*:*:*:* Versions 6.1.0.11 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.12:*:*:*:*:*:*:* Versions 6.1.0.12 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.13:*:*:*:*:*:*:* Versions 6.1.0.13 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.14:*:*:*:*:*:*:* Versions 6.1.0.14 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.15:*:*:*:*:*:*:* Versions 6.1.0.15 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.16:*:*:*:*:*:*:* Versions 6.1.0.16 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.17:*:*:*:*:*:*:* Versions 6.1.0.17 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.18:*:*:*:*:*:*:* Versions 6.1.0.18 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.19:*:*:*:*:*:*:* Versions 6.1.0.19 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.20:*:*:*:*:*:*:* Versions 6.1.0.20 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.21:*:*:*:*:*:*:* Versions 6.1.0.21 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.22:*:*:*:*:*:*:* Versions 6.1.0.22 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.23:*:*:*:*:*:*:* Versions 6.1.0.23 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:* Versions 7.0.0.1 Vulnerable ·IBM
  • cpe:2.3:a:mono_project:mono:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Mono Project
  • cpe:2.3:a:mono_project:mono:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Mono Project
  • cpe:2.3:a:mono_project:mono:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·Mono Project
  • cpe:2.3:a:mono_project:mono:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·Mono Project
  • cpe:2.3:a:mono_project:mono:1.2.5:*:*:*:*:*:*:* Versions 1.2.5 Vulnerable ·Mono Project
  • cpe:2.3:a:mono_project:mono:1.2.6:*:*:*:*:*:*:* Versions 1.2.6 Vulnerable ·Mono Project
  • cpe:2.3:a:mono_project:mono:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·Mono Project
  • cpe:2.3:a:mono_project:mono:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Mono Project
  • cpe:2.3:a:oracle:application_server:10.1.2.3:*:*:*:*:*:*:* Versions 10.1.2.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_server:10.1.3.4:*:*:*:*:*:*:* Versions 10.1.3.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_server:10.1.4.3im:*:*:*:*:*:*:* Versions 10.1.4.3im Vulnerable ·Oracle
  • cpe:2.3:a:oracle:bea_product_suite:8.1:sp6:*:*:*:*:*:* Versions 8.1 sp6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:bea_product_suite:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:bea_product_suite:9.1:*:*:*:*:*:*:* Versions 9.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:bea_product_suite:9.2:mp3:*:*:*:*:*:* Versions 9.2 mp3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:bea_product_suite:10.0:mp1:*:*:*:*:*:* Versions 10.0 mp1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:bea_product_suite:10.3:*:*:*:*:*:*:* Versions 10.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server_component:8.1:sp6:*:*:*:*:*:* Versions 8.1 sp6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server_component:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server_component:9.1:*:*:*:*:*:*:* Versions 9.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server_component:9.2:mp3:*:*:*:*:*:* Versions 9.2 mp3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server_component:10.0:mp1:*:*:*:*:*:* Versions 10.0 mp1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server_component:10.3:*:*:*:*:*:*:* Versions 10.3 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-8hfm-837h-hjg5 org.apache.santuario:xmlsec (Maven) Fixed in 1.4.3 Advisory →

Red Hat 9 advisories

  • RHSA-2010:0043 Released 2010-01-14 · Red Hat rating Low
    Red Hat Network Satellite Server IBM Java Runtime security update
    • Red Hat Satellite 5.3 (RHEL v.4) java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-devel-1:1.6.0.7-1jpp.3.el4 +1
    • Red Hat Satellite 5.3 (RHEL v.5) java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5, java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5.i386, java-1.6.0-ibm-devel-1:1.6.0.7-1jpp.2.el5 +1
  • RHSA-2009:1694 Released 2009-12-23 · Red Hat rating Critical
    java-1.6.0-ibm security update
    • Red Hat Desktop version 4 Extras java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.7-1jpp.3.el4 +11
    • Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.ppc +18
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5, java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5.i386, java-1.6.0-ibm-accessibility-1:1.6.0.7-1jpp.2.el5 +13
    • Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.7-1jpp.3.el4 +11
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5, java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5.i386, java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5.ppc +21
    • Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.7-1jpp.3.el4 +11
  • RHSA-2009:1650 Released 2009-12-10 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 4.2.0.CP08 update
    • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server glassfish-jsf-1.2_13-2.1.ep1.el5, hibernate3-1:3.2.4-1.SP1_CP09.0jpp.ep1.2.4.el5, hibernate3-annotations-3.3.1-1.11GA_CP02.ep1.el5 +22
Show 6 more Red Hat advisories
  • RHSA-2009:1649 Released 2009-12-09 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 4.3.0.CP07 update
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server glassfish-jaxb-2.1.4-1.12.patch03.1.ep1.el5, glassfish-jaxb-javadoc-2.1.4-1.12.patch03.1.ep1.el5, glassfish-jsf-1.2_13-2.1.ep1.el5 +31
  • RHSA-2009:1637 Released 2009-12-09 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 4.2.0.CP08 update
    • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS glassfish-javamail-1.4.2-0jpp.ep1.5.el4, glassfish-jsf-1.2_13-2.1.ep1.el4, hibernate3-1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4 +25
    • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES glassfish-javamail-1.4.2-0jpp.ep1.5.el4, glassfish-jsf-1.2_13-2.1.ep1.el4, hibernate3-1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4 +25
  • RHSA-2009:1636 Released 2009-12-09 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 4.3.0.CP07 update
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS glassfish-javamail-1.4.2-0jpp.ep1.5.el4, glassfish-jaxb-2.1.4-1.12.patch03.ep1.el4, glassfish-jaxb-javadoc-2.1.4-1.12.patch03.ep1.el4 +34
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES glassfish-javamail-1.4.2-0jpp.ep1.5.el4, glassfish-jaxb-2.1.4-1.12.patch03.ep1.el4, glassfish-jaxb-javadoc-2.1.4-1.12.patch03.ep1.el4 +34
  • RHSA-2009:1428 Released 2009-09-08 · Red Hat rating Moderate
    xmlsec1 security update
    • Red Hat Enterprise Linux (v. 5 server) xmlsec1-1.2.9-8.1.1, xmlsec1-1.2.9-8.1.1.i386, xmlsec1-1.2.9-8.1.1.ia64 +29
    • Red Hat Enterprise Linux AS version 4 xmlsec1-1.2.6-3.1, xmlsec1-1.2.6-3.1.i386, xmlsec1-1.2.6-3.1.ia64 +13
    • Red Hat Enterprise Linux Desktop (v. 5 client) xmlsec1-1.2.9-8.1.1, xmlsec1-1.2.9-8.1.1.i386, xmlsec1-gnutls-1.2.9-8.1.1 +5
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xmlsec1-1.2.9-8.1.1, xmlsec1-devel-1.2.9-8.1.1, xmlsec1-devel-1.2.9-8.1.1.i386 +6
    • Red Hat Enterprise Linux Desktop version 4 xmlsec1-1.2.6-3.1, xmlsec1-1.2.6-3.1.i386, xmlsec1-devel-1.2.6-3.1 +5
    • Red Hat Enterprise Linux ES version 4 xmlsec1-1.2.6-3.1, xmlsec1-1.2.6-3.1.i386, xmlsec1-1.2.6-3.1.ia64 +9
    • Red Hat Enterprise Linux WS version 4 xmlsec1-1.2.6-3.1, xmlsec1-1.2.6-3.1.i386, xmlsec1-1.2.6-3.1.ia64 +9
  • RHSA-2009:1201 Released 2009-08-06 · Red Hat rating Important
    java-1.6.0-openjdk security and bug fix update
    • Red Hat Enterprise Linux (v. 5 server) java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5, java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386, java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5 +7
    • Red Hat Enterprise Linux Desktop (v. 5 client) java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5, java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386, java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5 +7
  • RHSA-2009:1200 Released 2009-08-06 · Red Hat rating Critical
    java-1.6.0-sun security update
    • Red Hat Desktop version 4 Extras java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el4 +9
    • Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el4 +9
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-sun-1:1.6.0.15-1jpp.1.el5, java-1.6.0-sun-1:1.6.0.15-1jpp.1.el5.i586, java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el5 +9
    • Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el4 +9
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-sun-1:1.6.0.15-1jpp.1.el5, java-1.6.0-sun-1:1.6.0.15-1jpp.1.el5.i586, java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el5 +9
    • Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el4 +9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 4 ExtrasFixed RHSA-2009:1200, RHSA-2009:1694
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:1201, RHSA-2009:1428
Red Hat Enterprise Linux AS version 4Fixed RHSA-2009:1428
Red Hat Enterprise Linux AS version 4 ExtrasFixed RHSA-2009:1200, RHSA-2009:1694
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:1201, RHSA-2009:1428
Red Hat Enterprise Linux Desktop Supplementary (v. 5)Fixed RHSA-2009:1200, RHSA-2009:1694
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2009:1428
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2009:1428
Red Hat Enterprise Linux ES version 4Fixed RHSA-2009:1428
Red Hat Enterprise Linux ES version 4 ExtrasFixed RHSA-2009:1200, RHSA-2009:1694
Red Hat Enterprise Linux Server Supplementary (v. 5)Fixed RHSA-2009:1200, RHSA-2009:1694
Red Hat Enterprise Linux WS version 4Fixed RHSA-2009:1428
Red Hat Enterprise Linux WS version 4 ExtrasFixed RHSA-2009:1200, RHSA-2009:1694
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ASFixed RHSA-2009:1637
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ESFixed RHSA-2009:1637
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 ServerFixed RHSA-2009:1650
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ASFixed RHSA-2009:1636
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ESFixed RHSA-2009:1636
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 ServerFixed RHSA-2009:1649
Red Hat Satellite 5.3 (RHEL v.4)Fixed RHSA-2010:0043
Red Hat Satellite 5.3 (RHEL v.5)Fixed RHSA-2010:0043

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-0217
  2. 2026-10-03 Alias added: GHSA-8hfm-837h-hjg5

References

Patch 7

Advisory 32

Other 41

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences