Security Bulletin: IBM Sterling B2B Integrator vulnerable to security bypass due to Apache Santuario XML Security for Java (CVE-2021-40690, CVE-2014-8152)

Summary BM Sterling B2B Integrator has addressed the secuirty vulnerabilities in Apache Santurio XML Security. Vulnerability Details CVEID:CVE-2021-40690 DESCRIPTION: Apache Santuario XML Security for Java could allow a remote attacker to bypass security restrictions, caused by the improper passi...

com.cybersource:cybersource-sdk-java (>=6.0.1, <=6.1.0), com.googlecode.xades4j:xades4j (1.3.2) +62 more potentially affected by CVE-2014-8152 via org.apache.santuario:xmlsec (>=2.0.0, <=2.0.2)

org.apache.santuario:xmlsec MAVEN version =2.0.0, =6.0.1, =2.0.5, =1.0.4, =1.0, =0.9, =0.9, =2.14.0, =3.0.0, =3.0.0, =3.0.0, =3.0.3 and more Source cves: CVE-2014-8152 Source advisory: MEND:CVE-2014-8152...

CVE-2014-8152

CVE-2014-8152 affects Apache Santuario XML Security for Java 2.0.x prior to 2.0.3. The vulnerability arises from improper handling in the streaming XML Signature verification, allowing a remote attacker to bypass the streaming XML signature protection mechanism and potentially modify a crafted XM...