XML Signature Spoofing Vulnerability in libxml-security-java
Summary
CVE-2013-2172: jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the Canon... Affects libxml-security-java versions < 1.5.5-2. Fixed in 1.5.5-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml-security-java is a Java library that provides XML security features, including XML signature and encryption. It is widely used in applications that require secure data transmission and integrity verification. The library implements various standards for XML security, making it a critical component for applications handling sensitive information. However, certain versions of this library are vulnerable to a spoofing attack that can compromise the integrity of XML signatures.
Vulnerability Detail
The vulnerability, identified as CVE-2013-2172, exists in the DOMCanonicalizationMethod.java file of Apache Santuario XML Security for Java. It allows context-dependent attackers to spoof an XML Signature by manipulating the CanonicalizationMethod parameter to apply a weak canonicalization algorithm to the SignedInfo part of the Signature. This flaw can lead to unauthorized access or data manipulation, posing significant risks to applications relying on XML signatures for security.
How To Fix
Minimum fixed version
1.5.5-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxml-security-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to restrict the CanonicalizationMethod parameter to only trusted algorithms. This can help mitigate the risk of spoofing until a proper fix is applied.
Conclusion
The CVE-2013-2172 vulnerability in libxml-security-java poses a significant risk to applications that utilize XML signatures for security. It is crucial for users to upgrade to the patched version to safeguard against potential spoofing attacks. Additionally, using tools like Vulert can help monitor and identify vulnerabilities in your software.
See every vulnerability recorded for libxml-security-java →
FAQ
CVE-2013-2172 is a vulnerability in the libxml-security-java library that allows attackers to spoof XML signatures by exploiting weak canonicalization methods.
Versions 1.4.x before 1.4.8 and 1.5.x before 1.5.5 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing your manifest file. Visit Vulert Scanner to check your application without any signup.
If exploited, this vulnerability can lead to unauthorized access, data manipulation, and a breach of data integrity in applications that rely on XML signatures.
Yes, implementing strict input validation for the CanonicalizationMethod parameter can help mitigate the risk until an upgrade is performed.
Related vulnerabilities
Recent vulnerabilities recorded for libxml-security-java.
