Apache Santuario - XML Security for Java: Private Key Disclosure
Summary
CVE-2023-44483: Apache Santuario - XML Security for Java are vulnerable to private key disclosure. Affects org.apache.santuario:xmlsec across 3 version ranges.
< 2.2.6
>= 2.3.0, < 2.3.4
>= 3.0.0, < 3.0.3
Fixed in 2.2.6, 2.3.4 or 3.0.3, depending on the release line you run. How to fix ↓
Also tracked for
- libxml-security-java · Debian:11
The same CVE-2023-44483 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Santuario - XML Security for Java is a library that provides XML digital signature and encryption functionality. It is commonly used in Java applications to secure XML data. However, versions prior to 2.2.6, 2.3.4, and 3.0.3 are vulnerable to a specific issue related to private key disclosure.
Vulnerability Detail
The vulnerability in Apache Santuario - XML Security for Java arises when using the JSR 105 API. In certain scenarios, when generating an XML Signature and logging with debug level enabled, a private key may be inadvertently disclosed in log files. This can lead to unauthorized access to sensitive information and compromise the security of the application. It is important to note that this vulnerability affects all versions prior to 2.2.6, 2.3.4, and 3.0.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.2.62.2.6 -
>= 2.3.0, < 2.3.42.3.4 -
>= 3.0.0, < 3.0.33.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to the fixed versions is the recommended solution.
Conclusion
The vulnerability in Apache Santuario - XML Security for Java can lead to the disclosure of private keys in log files, compromising the security of the application. It is crucial to upgrade to the fixed versions (2.2.6, 2.3.4, or 3.0.3) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.santuario:xmlsec →
FAQ
Apache Santuario - XML Security for Java is a library that provides XML digital signature and encryption functionality for Java applications.
The vulnerability allows for the disclosure of private keys in log files, which can lead to unauthorized access to sensitive information and compromise the security of the application.
All versions prior to 2.2.6, 2.3.4, and 3.0.3 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3 of Apache Santuario - XML Security for Java.
No specific workaround is available for this vulnerability. Upgrading to the fixed versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.santuario:xmlsec.
