CVE-2013-4517: Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type…

Unscored severity · published Jan 11, 2014

CVE-2013-4517

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type…

–

CVSS

8.9%

EPSS

On KEV

Description

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.

Exploitation

Is it being used?

Exploit prediction (EPSS)8.9% · higher than 95% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Santuario Xml Security For Java · Apache

through 1.5.5; 1.2.0; 1.2.1; 1.3.0; 1.4.0; 1.4.1; +12 more · source: NVD

Affected product

Santuario Xml Security For Java

Apache

All Santuario Xml Security For Java CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2013-4517

CVE.org

https://www.cve.org/CVERecord?id=CVE-2013-4517

osvdb.org

http://osvdb.org/101169

packetstormsecurity.com

http://packetstormsecurity.com/files/124554/Java-XML-Signature-Denial-Of-Service-Attack.html

rhn.redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0170.html

rhn.redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0171.html

rhn.redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0172.html

rhn.redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0195.html

More from Santuario Xml Security For Java

7.5

CVE-2021-40690

Bypass of the secureValidation property

6.5

CVE-2023-44483

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be…

5.5

CVE-2019-12400

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders

–

CVE-2014-8152

Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document

–

CVE-2013-2172

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to…