Not rated
CVE-2021-40690 All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the…
Description
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Santuario | Versions not published |
References
- lists.apache.org lists.apache.org
- [tomee-commits] 20210922 [tomee] 02/02: Update xmlsec to 2.2.3 to mitigate CVE-2021-40690 lists.apache.org
- [tomee-commits] 20210923 [jira] [Resolved] (TOMEE-3798) TomEE (8.0.8) is affected by CVE-2021-40690 vulnerability lists.apache.org
- [tomee-commits] 20210923 [jira] [Created] (TOMEE-3798) TomEE (8.0.8) is affected by CVE-2021-40690 vulnerability lists.apache.org
- [tomee-commits] 20210923 [jira] [Assigned] (TOMEE-3798) TomEE (8.0.8) is affected by CVE-2021-40690 vulnerability lists.apache.org
- [tomee-commits] 20210923 [jira] [Updated] (TOMEE-3798) TomEE (8.0.8) is affected by CVE-2021-40690 vulnerability lists.apache.org
- [poi-user] 20210923 Re: CVE-2021-40690 on xmlsec jar lists.apache.org
- [debian-lts-announce] 20210927 [SECURITY] [DLA 2767-1] libxml-security-java security update lists.debian.org
- [cxf-issues] 20211027 [jira] [Created] (CXF-8613) High Security issues reported with Apache Santuario library bundled in CXF 3.4.4 lists.apache.org
- [tomee-commits] 20211028 [jira] [Updated] (TOMEE-3798) TomEE (8.0.8) is affected by CVE-2021-40690 vulnerability lists.apache.org
- DSA-5010 www.debian.org
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified