CVE-2023-44483CWE-532

Apache Santuario: Private Key disclosure in debug-log output

published October 20, 2023

CVSS
—
EPSS
2%
Percentile
74.8
In the wild
Unconfirmed
What it is

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01547 · 74.8th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2023-10-20T09:23Z
EPSS history
Timeline
  • 20 OCT 09:23Z
    Apache Santuario: Private Key disclosure in debug-log output
    cvelistv5