CVE-2013-2155

2013-08-2022:55:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2013-2155

apache santuario

xml security

c++

denial of service

spoofing

vulnerability

nvd

7.5 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

0.008 Low

EPSS

Percentile

81.5%

JSON

Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the (1) compareBase64StringToRaw, (2) DSIGAlgorithmHandlerDefault, or (3) DSIGAlgorithmHandlerDefault::verify functions.

CPENameOperatorVersion
apache:xml_security_for_c\+\+apache xml security for c\+\+eq1.6.0
apache:xml_security_for_c\+\+apache xml security for c\+\+eq1.1.0
apache:xml_security_for_c\+\+apache xml security for c\+\+eq1.6.1
apache:xml_security_for_c\+\+apache xml security for c\+\+eq1.2.1
apache:xml_security_for_c\+\+apache xml security for c\+\+eq1.5.1
apache:xml_security_for_c\+\+apache xml security for c\+\+eq1.5.0
apache:xml_security_for_c\+\+apache xml security for c\+\+eq0.2.0
apache:xml_security_for_c\+\+apache xml security for c\+\+eq1.3.0
apache:xml_security_for_c\+\+apache xml security for c\+\+le1.7.0
apache:xml_security_for_c\+\+apache xml security for c\+\+eq1.4.0

CPE	Name	Operator	Version
apache:xml_security_for_c\+\+	apache xml security for c\+\+	eq	1.6.0
apache:xml_security_for_c\+\+	apache xml security for c\+\+	eq	1.1.0
apache:xml_security_for_c\+\+	apache xml security for c\+\+	eq	1.6.1
apache:xml_security_for_c\+\+	apache xml security for c\+\+	eq	1.2.1
apache:xml_security_for_c\+\+	apache xml security for c\+\+	eq	1.5.1
apache:xml_security_for_c\+\+	apache xml security for c\+\+	eq	1.5.0
apache:xml_security_for_c\+\+	apache xml security for c\+\+	eq	0.2.0
apache:xml_security_for_c\+\+	apache xml security for c\+\+	eq	1.3.0
apache:xml_security_for_c\+\+	apache xml security for c\+\+	le	1.7.0
apache:xml_security_for_c\+\+	apache xml security for c\+\+	eq	1.4.0