High · published September 19, 2021
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
| Product | Versions | Fixed in |
|---|---|---|
| apache/santuario_xml_security_for_java | < 2.1.7 | 2.1.7 |
| apache/santuario_xml_security_for_java | ≥ 2.2.0, < 2.2.3 | 2.2.3 |
| apache/cxf | all versions | — |
| apache/tomee | < 8.0.8 | 8.0.8 |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/commerce_guided_search | all versions | — |
| oracle/commerce_platform | all versions | — |
| oracle/communications_diameter_intelligence_hub | ≥ 8.0.0, ≤ 8.1.0 | — |
| oracle/communications_diameter_intelligence_hub | ≥ 8.2.0, ≤ 8.2.3 | — |
| oracle/communications_messaging_server | all versions | — |
| oracle/flexcube_private_banking | all versions | — |
| oracle/outside_in_technology | all versions | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| oracle/retail_bulk_data_integration | all versions | — |
| oracle/retail_financial_integration | all versions | — |
| oracle/retail_financial_integration | all versions | — |
| oracle/retail_financial_integration | all versions | — |
| oracle/retail_financial_integration | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |