CVE-2013-5823: Apache XML Security For Java vulnerable to Infinite Loop
Summary
CVE-2013-5823: Apache XML Security For Java vulnerable to Infinite Loop. Affects org.apache.santuario:xmlsec across 2 version ranges.
>= 1.4.0, < 1.4.8
>= 1.5.0, < 1.5.3
Fixed in 1.4.8 or 1.5.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache XML Security For Java (xmlsec) is a library used for securing XML messages by providing digital signatures, encryption, and other security features. It is commonly used in Java applications to ensure the integrity and confidentiality of XML data. However, certain versions of xmlsec are susceptible to a denial of service vulnerability.
Vulnerability Detail
The vulnerability in xmlsec arises when checking the signature of a message larger than 512 MB. In such cases, the method expandSize(int newPos) of the org.apache.xml.security.utils.UnsyncByteArrayOutputStream class enters an endless loop. This flaw can be exploited by a remote attacker who supplies crafted XML, leading to a denial of service. The impact of this vulnerability is the unavailability of the affected service, potentially disrupting the normal operation of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.4.0, < 1.4.81.4.8 -
>= 1.5.0, < 1.5.31.5.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the xmlsec library to a non-vulnerable version.
Conclusion
The vulnerability in Apache XML Security For Java can lead to a denial of service if a remote attacker supplies crafted XML to check the signature of a large message. To mitigate this issue, it is crucial to upgrade the xmlsec library to a fixed version. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.santuario:xmlsec →
FAQ
Apache XML Security For Java (xmlsec) is a library used for securing XML messages by providing digital signatures, encryption, and other security features in Java applications.
The vulnerability can be exploited by a remote attacker to cause a denial of service, resulting in the unavailability of the affected service and potential disruption of the application's normal operation.
To fix this vulnerability, it is recommended to upgrade the xmlsec library to a non-vulnerable version. For versions 1.4.0 to 1.4.8, upgrade to version 1.4.8 or later. For versions 1.5.0 to 1.5.3, upgrade to version 1.5.3 or later.
No, there is no known workaround for this vulnerability. It is necessary to apply the recommended fix by upgrading the xmlsec library.
For more information about this vulnerability, you can refer to the CVE-2013-5823 advisory or the GitHub advisory database.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.santuario:xmlsec.
