CVE-2013-2172

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2013-2172

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2013-2172.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2013-2172

Aliases

GHSA-r237-w2w6-jq3p

Related

Published

2013-08-20T22:55:04Z

Modified

2024-09-11T02:00:07Z

Summary

[none]

Details

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."

References

Affected packages

Debian:11 / libxml-security-java

Package

Name: libxml-security-java
Purl: pkg:deb/debian/libxml-security-java?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.5-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / libxml-security-java

Package

Name: libxml-security-java
Purl: pkg:deb/debian/libxml-security-java?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.5-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / libxml-security-java

Package

Name: libxml-security-java
Purl: pkg:deb/debian/libxml-security-java?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.5-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}