CVE-2019-12400
Description
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.
How to fix
- apache santuario_xml_security_for_java2.1.4 or later
- org.apache.santuario:xmlsec2.1.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache santuario_xml_security_for_java | 2.0.3 ≤ v ≤ 2.0.10, 2.1.0 ≤ v < 2.1.4 | 2.1.4 |
| redhat jboss_enterprise_application_platform | 7.2 | — |
| oracle weblogic_server | 12.2.1.4.0, 14.1.1.0.0 | — |
| org.apache.santuario:xmlsecMaven | 2.0.3 ≤ v < 2.1.4 | 2.1.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.