Unscored severity · published Aug 20, 2013
CVE-2013-2172
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to…
–
CVSS
5.9%
EPSS
No
On KEV
Description
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."
Exploitation
Is it being used?
Exploit prediction (EPSS)5.9% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SX
Santuario Xml Security For Java · Apache
1.4.7; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2172
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1207.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1208.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1209.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1217.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1218.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1219.html
More from Santuario Xml Security For Java
7.5
CVE-2021-40690
Bypass of the secureValidation property
6.5
CVE-2023-44483
All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be…
5.5
CVE-2019-12400
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders
–
CVE-2014-8152
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document
–
CVE-2013-4517
Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type…