Critical Vulnerability in libxml-security-java: Apache XML Security for Java XPath Transform Issue
Summary
USN-5525-1: libxml-security-java vulnerability. Affects libxml-security-java versions < 2.0.10-2~18.04.1. Fixed in 2.0.10-2~18.04.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml-security-java is a library that provides XML security features for Java applications, enabling developers to implement secure XML signatures and encryption. It is widely used in various applications to ensure data integrity and confidentiality. However, a vulnerability has been identified that affects its ability to handle specific key elements securely, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2021-40690, arises from improper handling of a configuration property when creating specific key elements in Apache XML Security for Java. This flaw allows attackers to exploit an XPath Transform, leading to the extraction of sensitive information from the XML data. The implications of this vulnerability are significant, as it could enable unauthorized access to confidential data, compromising the security of applications that rely on this library.
How To Fix
Minimum fixed version
2.0.10-2~18.04.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxml-security-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the affected application or implementing additional security layers to protect sensitive data until the package can be updated. Regularly monitor your application for any unusual activity that may indicate exploitation attempts.
Conclusion
In summary, the libxml-security-java vulnerability (CVE-2021-40690) poses a significant risk to applications relying on this library for XML security. It is crucial to update to the patched versions provided for Ubuntu 18.04 and 20.04 LTS to mitigate potential threats. Regular monitoring and additional security measures are recommended until the update can be applied.
See every vulnerability recorded for libxml-security-java →
FAQ
CVE-2021-40690 is a vulnerability in the libxml-security-java package that allows attackers to exploit an XPath Transform to extract sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include unauthorized access to sensitive data, which could lead to data breaches and compromise the integrity of applications using the affected library.
Yes, a patched version of libxml-security-java is available. Users should update to version 2.0.10-2~18.04.1 for Ubuntu 18.04 LTS or 2.0.10-2+deb11u1build0.20.04.1 for Ubuntu 20.04 LTS.
If immediate updates are not possible, consider implementing additional security measures and monitoring your application for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml-security-java.
