CVE-2021-40690: Apache Santuario - XML Security for Java Exposure of Sensitive Information
Summary
CVE-2021-40690: Exposure of Sensitive Information to an Unauthorized Actor in Apache Santuario. Affects org.apache.santuario:xmlsec across 2 version ranges.
< 2.1.7
>= 2.2.0, < 2.2.3
Fixed in 2.1.7 or 2.2.3, depending on the release line you run. How to fix ↓
Also tracked for
- libxml-security-java · Debian:11
The same CVE-2021-40690 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Santuario - XML Security for Java is a library that provides XML digital signature and encryption functionality. It is commonly used in Java applications to secure XML data. However, versions prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This vulnerability allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Vulnerability Detail
The vulnerability in Apache Santuario - XML Security for Java arises from the incorrect handling of the "secureValidation" property. By exploiting this issue, an unauthorized actor can utilize an XPath Transform to extract sensitive information from local .xml files. This can lead to unauthorized access to confidential data and potential security breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.72.1.7 -
>= 2.2.0, < 2.2.32.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed versions of Apache Santuario - XML Security for Java to address the issue effectively.
Conclusion
The vulnerability in Apache Santuario - XML Security for Java exposes sensitive information to unauthorized actors, potentially leading to security breaches. It is crucial to upgrade to the fixed versions (2.2.3 or 2.1.7) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.santuario:xmlsec →
FAQ
Apache Santuario - XML Security for Java is a library that provides XML digital signature and encryption functionality for Java applications.
This vulnerability allows an attacker to extract sensitive information from local .xml files, potentially leading to unauthorized access and security breaches.
To fix this vulnerability, it is recommended to upgrade to Apache Santuario - XML Security for Java version 2.2.3 or 2.1.7, depending on the version currently in use.
No, there is no known workaround for this vulnerability. Upgrading to the fixed versions is the recommended solution.
You can find more information about this vulnerability in the Apache Santuario - XML Security for Java advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-j8wc-gxx9-82hx/GHSA-j8wc-gxx9-82hx.json
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.santuario:xmlsec.
