Sensitive Key Disclosure in Apache Santuario - XML Security for Java (CVE-2023-44483)
Summary
CVE-2023-44483: All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML S... Affects libxml-security-java versions < a6fdd4a275fdf6b50fb5c0a8edef5be7c6e7347c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Santuario - XML Security for Java is a library that provides a framework for signing and encrypting XML documents. It implements the XML Signature and XML Encryption standards, allowing developers to secure XML data in their applications. The library is widely used in various Java applications to ensure data integrity and confidentiality. However, certain versions of this library are vulnerable to a significant issue where private keys may be inadvertently logged, posing a security risk.
Vulnerability Detail
The vulnerability identified as CVE-2023-44483 affects all versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3. When using the JSR 105 API, if debug-level logging is enabled during the generation of an XML Signature, private keys may be disclosed in the log files. This could lead to unauthorized access to sensitive information, as attackers could potentially retrieve these keys from the logs. The issue arises from improper handling of sensitive data in logging mechanisms, which can have severe implications for the security of applications relying on this library.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately feasible, users can temporarily disable debug-level logging to mitigate the risk of private key disclosure. This can usually be done by adjusting the logging configuration in the application. For example, in a log4j configuration file, set the log level to INFO or higher:
log4j.rootLogger=INFO, console
Conclusion
CVE-2023-44483 presents a significant risk to users of Apache Santuario - XML Security for Java due to the potential exposure of private keys in log files. It is crucial for users to upgrade to the recommended versions to mitigate this vulnerability. Additionally, disabling debug-level logging can serve as a temporary workaround until an upgrade can be performed.
See every vulnerability recorded for libxml-security-java →
FAQ
CVE-2023-44483 is a vulnerability in Apache Santuario - XML Security for Java that allows private keys to be disclosed in log files when debug-level logging is enabled.
All versions prior to 2.2.6, 2.3.4, and 3.0.3 are affected by this vulnerability.
If exploited, this vulnerability could lead to unauthorized access to sensitive private keys, compromising the security of applications that rely on the library.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without any installation.
The CVSS score for CVE-2023-44483 is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libxml-security-java.
