Improper resource allocation In org.apache.santuario:xmlsec
Description
Inefficient Algorithmic Complexity in Apache Santuario XML Security
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 maven | 1.4.8, 1.5.5 | ||
 debian 13 | 1.5.5-2 | ||
debian 12 | 1.5.5-2 | ||
debian 14 | 1.5.5-2 | ||
maven | 1.4.8, 1.5.5 |
Aliases
1. 2. 3. 4. 5. 6. 7. 8.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. 27.