Apache Santuario: Private Key disclosure in debug-log output
Priority LOW 32CWE-532Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 11 fixed, 9 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.
Summary
All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01547 75th percentileScored 2026-11-07
Fix Partial Apache Santuario (Apache Software Foundation): 2.2.6, 2.3.4, 3.0.3org.apache.santuario:xmlsec (Maven): 2.3.4, 2.2.6, 3.0.3Red Hat: 11 advisoriesRed Hat: 11 fixed, 9 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Santuario | 2.2 to before 2.2.6; 2.3 to before 2.3.4; 3.0 to before 3.0.3 | 2.2.6, 2.3.4, 3.0.3 | Patch available | CNA |
| — | org.apache.santuario:xmlsec (Maven) | 2.3.0 to before 2.3.4 | 2.3.4 | Patch available | GHSA-xfrj-6vvc-3xm2 |
| — | org.apache.santuario:xmlsec (Maven) | before 2.2.6 | 2.2.6 | Patch available | GHSA-xfrj-6vvc-3xm2 |
| — | org.apache.santuario:xmlsec (Maven) | 3.0.0 to before 3.0.3 | 3.0.3 | Patch available | GHSA-xfrj-6vvc-3xm2 |
- Apache Santuario VendorApache Affected 2.2 to before 2.2.6; 2.3 to before 2.3.4; 3.0 to before 3.0.3 Fixed in 2.2.6, 2.3.4, 3.0.3 Patch available CNA
- org.apache.santuario:xmlsec (Maven) Vendor— Affected 2.3.0 to before 2.3.4 Fixed in 2.3.4 Patch available GHSA-xfrj-6vvc-3xm2
- org.apache.santuario:xmlsec (Maven) Vendor— Affected before 2.2.6 Fixed in 2.2.6 Patch available GHSA-xfrj-6vvc-3xm2
- org.apache.santuario:xmlsec (Maven) Vendor— Affected 3.0.0 to before 3.0.3 Fixed in 3.0.3 Patch available GHSA-xfrj-6vvc-3xm2
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:santuario_xml_security_for_java:*:*:*:*:*:*:*:* | before 2.2.6; 2.3.0 to before 2.3.4; 3.0.0 to before 3.0.3 | Vulnerable | Apache |
- cpe:2.3:a:apache:santuario_xml_security_for_java:*:*:*:*:*:*:*:* Versions before 2.2.6; 2.3.0 to before 2.3.4; 3.0.0 to before 3.0.3 Vulnerable ·Apache
Remediation
- Fix · CNA Apache Santuario (Apache Software Foundation) Fixed in 2.2.6, 2.3.4, 3.0.3
- Fix · GHSA-xfrj-6vvc-3xm2 org.apache.santuario:xmlsec (Maven) Fixed in 2.3.4 Advisory →
- Fix · GHSA-xfrj-6vvc-3xm2 org.apache.santuario:xmlsec (Maven) Fixed in 2.2.6 Advisory →
- Fix · GHSA-xfrj-6vvc-3xm2 org.apache.santuario:xmlsec (Maven) Fixed in 3.0.3 Advisory →
Red Hat 11 advisories
- RHSA-2024:3708 Released 2024-06-06 · Red Hat rating ImportantRed Hat Build of Apache Camel 3.20.6 for Spring Boot security update.
- Red Hat build of Apache Camel 3.20.6 for Spring Boot
- RHSA-2024:0804 Released 2024-02-13 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.7 security update
- Red Hat Single Sign-On 7
- RHSA-2024:0798 Released 2024-02-13 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.7 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.12-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.12-1.redhat_00001.1.el7sso
Show 8 more Red Hat advisories
- RHSA-2024:0800 Released 2024-02-13 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.7 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.12-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.12-1.redhat_00001.1.el9sso
- RHSA-2024:0799 Released 2024-02-13 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.7 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.12-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.12-1.redhat_00001.1.el8sso
- RHSA-2024:0801 Released 2024-02-13 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.7 for OpenShift image enhancement update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2024:0789 Released 2024-02-12 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.0 for Quarkus 3.2 release (RHBQ 3.2.10.Final)
- RHBOAC camel-quarkus 3 (camel-4.0/quarkus-3.2)
- RHSA-2024:0711 Released 2024-02-07 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.15 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-eclipse-jgit-5.13.2-1.SP1_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.14-7.SP08_redhat_00001.1.el8eap, eap7-hibernate-5.3.33-2.Final_redhat_00001.1.el8eap +47
- RHSA-2024:0710 Released 2024-02-07 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.15 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-eclipse-jgit-5.13.2-1.SP1_redhat_00001.1.el7eap, eap7-glassfish-jsf-2.3.14-7.SP08_redhat_00001.1.el7eap, eap7-hibernate-5.3.33-2.Final_redhat_00001.1.el7eap +47
- RHSA-2024:0712 Released 2024-02-07 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.15 security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-eclipse-jgit-5.13.2-1.SP1_redhat_00001.1.el9eap, eap7-glassfish-jsf-2.3.14-7.SP08_redhat_00001.1.el9eap, eap7-hibernate-5.3.33-2.Final_redhat_00001.1.el9eap +47
- RHSA-2024:0714 Released 2024-02-06 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.15 Security update
- Red Hat JBoss Enterprise Application Platform org.apache.santuario.xmlsec-2.2.6.redhat-00002.jar, org.eclipse.jgit.org.eclipse.jgit-5.13.2.SP1-redhat-00001.jar
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel Quarkus 2 | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix yet |
| Middleware Containers for OpenShift | Fixed | RHSA-2024:0801 |
| RHBOAC camel-quarkus 3 (camel-4.0/quarkus-3.2) | Fixed | RHSA-2024:0789 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2024:0710 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2024:0711 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2024:0712 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2024:0714 |
| Red Hat Single Sign-On 7 | Fixed | RHSA-2024:0804 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2024:0798 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2024:0799 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2024:0800 |
| Red Hat build of Apache Camel 3.20.6 for Spring Boot | Fixed | RHSA-2024:3708 |
Not affected: 6 products
- Logging Subsystem for Red Hat OpenShift
- Red Hat Data Grid 8
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat build of Apicurio Registry 2
Timeline
- 2026-10-02 Threatist record created from CVE-2023-44483
- 2026-10-03 Alias added: GHSA-xfrj-6vvc-3xm2
References
Advisory 3
More Apache Santuario Xml Security For Java vulnerabilities
- TI-2021-17647 Bypass of the secureValidation property CVSS 3.1HIGH 7.5
- TI-2014-06767 Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to… CVSS 2.0MEDIUM 5.0
- TI-2013-03964 Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows… CVSS 2.0MEDIUM 4.3
- TI-2013-01939 jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security… CVSS 2.0MEDIUM 4.3
- TI-2019-09247 Improper input validation in Apache Santuario - XML Security for Java CVSS 3.1MEDIUM 5.5
Sources
- CVE-2023-44483 · CVE Program
- CVE-2023-44483 · NVD
- FIRST EPSS
- GHSA-xfrj-6vvc-3xm2 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-44483 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences