jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security…
Priority LOW 29CWE-310Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Partial Red Hat: 19 fixed, 5 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-407.
Summary
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."
Why it matters now
EPSS 0.0593 93rd percentileScored 2026-11-07
Fix Partial org.apache.santuario:xmlsec (Maven): 1.4.8, 1.5.5Red Hat: 13 advisoriesRed Hat: 19 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.santuario:xmlsec (Maven) | 1.4.0 to before 1.4.8 | 1.4.8 | Patch available | GHSA-r237-w2w6-jq3p |
| — | org.apache.santuario:xmlsec (Maven) | 1.5.0 to before 1.5.5 | 1.5.5 | Patch available | GHSA-r237-w2w6-jq3p |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.santuario:xmlsec (Maven) Vendor— Affected 1.4.0 to before 1.4.8 Fixed in 1.4.8 Patch available GHSA-r237-w2w6-jq3p
- org.apache.santuario:xmlsec (Maven) Vendor— Affected 1.5.0 to before 1.5.5 Fixed in 1.5.5 Patch available GHSA-r237-w2w6-jq3p
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.7:*:*:*:*:*:*:* | 1.4.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.0:*:*:*:*:*:*:* | 1.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.1:*:*:*:*:*:*:* | 1.5.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.2:*:*:*:*:*:*:* | 1.5.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.3:*:*:*:*:*:*:* | 1.5.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.4:*:*:*:*:*:*:* | 1.5.4 | Vulnerable | Apache |
- cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.7:*:*:*:*:*:*:* Versions 1.4.7 Vulnerable ·Apache
- cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Apache
- cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·Apache
- cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·Apache
- cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.4:*:*:*:*:*:*:* Versions 1.5.4 Vulnerable ·Apache
Remediation
- Fix · GHSA-r237-w2w6-jq3p org.apache.santuario:xmlsec (Maven) Fixed in 1.4.8 Advisory →
- Fix · GHSA-r237-w2w6-jq3p org.apache.santuario:xmlsec (Maven) Fixed in 1.5.5 Advisory →
Red Hat 13 advisories
- RHSA-2014:1369 Released 2014-10-09 · Red Hat rating ImportantFuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
- Fuse ESB Enterprise 7.1.0
- Fuse MQ Enterprise 7.1.0
- Fuse Management Console 7.1.0
- RHSA-2014:0400 Released 2014-04-14 · Red Hat rating ModerateRed Hat JBoss Fuse 6.1.0 update
- Red Hat JBoss Fuse 6.1
- RHSA-2014:0212 Released 2014-02-25 · Red Hat rating ModerateRed Hat JBoss SOA Platform 5.3.1 update
- Red Hat JBoss SOA Platform 5.3
Show 10 more Red Hat advisories
- RHSA-2013:1853 Released 2013-12-17 · Red Hat rating ModerateRed Hat JBoss Operations Network 3.2.0 update
- Red Hat JBoss Operations Network 3.2
- RHSA-2013:1437 Released 2013-10-16 · Red Hat rating ImportantRed Hat JBoss Portal 6.1.0 update
- Red Hat JBoss Portal Platform 6.1
- RHSA-2013:1375 Released 2013-09-30 · Red Hat rating ModerateRed Hat JBoss BRMS 5.3.1 update
- JBoss Enterprise BRMS Platform 5.3
- RHSA-2013:1220 Released 2013-09-09 · Red Hat rating Moderatexml-security security update
- Red Hat JBoss Web Platform 5.2
- RHSA-2013:1219 Released 2013-09-09 · Red Hat rating Moderatexml-security security update
- Red Hat JBoss Web Platform 5 for RHEL 5 Server xml-security-1.5.1-3_patch01.ep5.el5
- Red Hat JBoss Web Platform 5 for RHEL 6 Server xml-security-1.5.1-3_patch01.ep5.el6
- RHSA-2013:1218 Released 2013-09-09 · Red Hat rating Moderatexml-security security update
- Red Hat JBoss Enterprise Application Platform 5.2
- RHSA-2013:1217 Released 2013-09-09 · Red Hat rating Moderatexml-security security update
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS xml-security-1.5.1-3_patch01.ep5.el4
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES xml-security-1.5.1-3_patch01.ep5.el4
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server xml-security-1.5.1-3_patch01.ep5.el5
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server xml-security-1.5.1-3_patch01.ep5.el6
- RHSA-2013:1209 Released 2013-09-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.1.1 update
- Red Hat JBoss Enterprise Application Platform 6.1
- RHSA-2013:1208 Released 2013-09-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.1.1 update
- Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server apache-commons-beanutils-1.8.3-12.redhat_3.2.ep6.el6, apache-commons-daemon-jsvc-eap6-1:1.0.15-2.redhat_2.ep6.el6, apache-commons-daemon-jsvc-eap6-1:1.0.15-2.redhat_2.ep6.el6.i386 +47
- RHSA-2013:1207 Released 2013-09-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.1.1 update
- Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server apache-commons-beanutils-1.8.3-12.redhat_3.2.ep6.el5, apache-commons-daemon-jsvc-eap6-1:1.0.15-2.redhat_2.ep6.el5, apache-commons-daemon-jsvc-eap6-1:1.0.15-2.redhat_2.ep6.el5.i386 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Operations Network 3 | Affected | No fix yet |
| Red Hat JBoss Portal 4 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Portal 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss SOA Platform 4 | Affected | No fix planned: Will not fix |
| Fuse ESB Enterprise 7.1.0 | Fixed | RHSA-2014:1369 |
| Fuse MQ Enterprise 7.1.0 | Fixed | RHSA-2014:1369 |
| Fuse Management Console 7.1.0 | Fixed | RHSA-2014:1369 |
| JBoss Enterprise BRMS Platform 5.3 | Fixed | RHSA-2013:1375 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS | Fixed | RHSA-2013:1217 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES | Fixed | RHSA-2013:1217 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server | Fixed | RHSA-2013:1217 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server | Fixed | RHSA-2013:1217 |
| Red Hat JBoss Enterprise Application Platform 5.2 | Fixed | RHSA-2013:1218 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server | Fixed | RHSA-2013:1207 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server | Fixed | RHSA-2013:1208 |
| Red Hat JBoss Enterprise Application Platform 6.1 | Fixed | RHSA-2013:1209 |
| Red Hat JBoss Fuse 6.1 | Fixed | RHSA-2014:0400 |
| Red Hat JBoss Operations Network 3.2 | Fixed | RHSA-2013:1853 |
| Red Hat JBoss Portal Platform 6.1 | Fixed | RHSA-2013:1437 |
| Red Hat JBoss SOA Platform 5.3 | Fixed | RHSA-2014:0212 |
| Red Hat JBoss Web Platform 5 for RHEL 5 Server | Fixed | RHSA-2013:1219 |
| Red Hat JBoss Web Platform 5 for RHEL 6 Server | Fixed | RHSA-2013:1219 |
| Red Hat JBoss Web Platform 5.2 | Fixed | RHSA-2013:1220 |
Not affected: 2 products
- Red Hat JBoss Web Platform 5 for RHEL 4 AS
- Red Hat JBoss Web Platform 5 for RHEL 4 ES
Timeline
- 2026-10-02 Threatist record created from CVE-2013-2172
- 2026-10-03 Alias added: GHSA-r237-w2w6-jq3p
References
Advisory 15
Other 13
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
- 94651
- [santuario-commits] 20190823 svn commit: r1049214 - in /websites/production/santuario/content: cache/main.pageCache download.html index.html javaindex.html javareleasenotes.html secadv.data/CVE-2019-12400.asc secadv.html
- [santuario-commits] 20210917 svn commit: r1076843 - in /websites/production/santuario/content: cache/main.pageCache index.html javaindex.html secadv.data/CVE-2021-40690.txt.asc secadv.html
- https://github.com/apache/santuario-java/commit/25e0e11493b061749f778030036cb5c406b34590
- https://github.com/apache/santuario-java/commit/8e8f8bf92a43608d7d5f9e357fae19244454a61f
- https://github.com/apache/santuario-java
- https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3@%3Ccommits.santuario.apache.org%3E
- https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd@%3Ccommits.santuario.apache.org%3E
- https://web.archive.org/web/20160317145515/http://www.securityfocus.com/archive/1/534161/100/0/threaded
- https://web.archive.org/web/20200228060314/http://www.securityfocus.com/bid/60846
More Apache Santuario Xml Security For Java vulnerabilities
- TI-2021-17647 Bypass of the secureValidation property CVSS 3.1HIGH 7.5
- TI-2023-23977 Apache Santuario: Private Key disclosure in debug-log output CVSS 3.1MEDIUM 6.5
- TI-2014-06767 Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to… CVSS 2.0MEDIUM 5.0
- TI-2013-03964 Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows… CVSS 2.0MEDIUM 4.3
- TI-2019-09247 Improper input validation in Apache Santuario - XML Security for Java CVSS 3.1MEDIUM 5.5
Sources
- CVE-2013-2172 · CVE Program
- CVE-2013-2172 · NVD
- FIRST EPSS
- GHSA-r237-w2w6-jq3p · GitHub Advisory Database · CC BY 4.0
- CVE-2013-2172 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences