PT-2023-6589 · Apache +1 · Apache Santuario Xml Security For Java +1

🗓️ 19 Oct 2023 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

Private key may be logged in debug logs for JSR 105 XML signatures in Apache Santuario Java before 2.2.6, 2.3.4, or 3.0.3.

Reporter	Title	Published	Views	Family All 126
IBM Security Bulletins	Security Bulletin: IBM PowerVM Novalink is vulnerable because Apache Santuario could allow a remote authenticated attacker to obtain sensitive information, caused by the storage of a private key in the log files.(CVE-2023-44483)	7 Feb 202416:59	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM® Engineering Lifecycle Engineering products using WebSphere Application Server Liberty is vulnerable to information disclosure due to Apache Santuario (CVE-2023-44483)	26 Dec 202305:51	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Santuario Vulnerability in WebSphere Application Server Liberty affect Cloud Pak System [CVE-2023-44483]	31 Jul 202422:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities	15 Apr 202503:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache XML Security for Java.	29 Sep 202522:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Predict Component uses WebSphere Application Server Liberty is vulnerable to information disclosure due to Apache Santuario which is vulnerable to CVE-2023-44483	28 Feb 202413:48	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of IBM WebSphere Application Server Liberty, IBM Tivoli Application Dependency Discovery Manager is vulnerable to denial of service and disclosure of sensitive information.	31 Jan 202415:27	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in WebSphere Liberty Profile shipped with IBM License Metric Tool v9.	13 Dec 202309:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Liberty for Java for IBM Cloud	14 Dec 202319:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to information disclosure due to Apache Santuario (CVE-2023-44483)	15 Nov 202320:01	–	ibm

Source	Link
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
osv	www.osv.dev/vulnerability/CVE-2023-44483
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-44483
security-tracker	www.security-tracker.debian.org/tracker/CVE-2023-44483
lists	www.lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55
osv	www.osv.dev/vulnerability/UBUNTU-CVE-2023-44483
osv	www.osv.dev/vulnerability/GHSA-xfrj-6vvc-3xm2
security-tracker	www.security-tracker.debian.org/tracker/source-package/libxml-security-java
bdu	www.bdu.fstec.ru/vul/2023-07354
safe-surf	www.safe-surf.ru/specialists/bulletins-nkcki/703843

08 Feb 2024 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 26.8

CVSS 3.16.5

EPSS0.00173

SSVC