CVE-2013-2172: Inefficient Algorithmic Complexity in Apache Santuario XML Security
Summary
CVE-2013-2172: Inefficient Algorithmic Complexity in Apache Santuario XML Security. Affects org.apache.santuario:xmlsec across 2 version ranges.
>= 1.4.0, < 1.4.8
>= 1.5.0, < 1.5.5
Fixed in 1.4.8 or 1.5.5, depending on the release line you run. How to fix ↓
Also tracked for
- libxml-security-java · Debian:11
The same CVE-2013-2172 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Santuario XML Security for Java is a library that provides XML digital signature and encryption functionality. It is commonly used in Java applications to secure XML documents and data. The library includes various classes and methods for generating and verifying XML signatures. However, a vulnerability has been discovered in the library that allows context-dependent attackers to spoof an XML Signature by exploiting an inefficient algorithmic complexity in the DOMCanonicalizationMethod class.
Vulnerability Detail
The vulnerability (CVE-2013-2172) arises from a weakness in the handling of the CanonicalizationMethod parameter in the DOMCanonicalizationMethod class. By specifying an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature", an attacker can manipulate the XML Signature and potentially bypass security measures. This can lead to various consequences, such as unauthorized access, data tampering, or information disclosure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.4.0, < 1.4.81.4.8 -
>= 1.5.0, < 1.5.51.5.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to a fixed version of Apache Santuario XML Security for Java.
Conclusion
The vulnerability in Apache Santuario XML Security for Java (CVE-2013-2172) allows attackers to manipulate XML Signatures and potentially bypass security measures. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of the library (1.4.8 or 1.5.5 or later). For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.santuario:xmlsec →
FAQ
Apache Santuario XML Security for Java is a library that provides XML digital signature and encryption functionality for Java applications.
The vulnerability allows attackers to spoof XML Signatures and potentially bypass security measures, leading to unauthorized access, data tampering, or information disclosure.
To fix this vulnerability, you should upgrade to a fixed version of Apache Santuario XML Security for Java (1.4.8 or 1.5.5 or later).
No, there is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to a fixed version of Apache Santuario XML Security for Java.
You can find more information about this vulnerability in the CVE-2013-2172 advisory and the GitHub advisory database.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.santuario:xmlsec.
