Lucene search
RootSSV:60867HistoryJul 02, 2013 - 12:00 a.m.
Apache XML Security签名伪造漏洞
2013-07-0200:00:00
Root
www.seebug.org
24
0.005 Low
EPSS
Percentile
73.3%
CVE ID:CVE-2013-2172
Apache XML Security是一个XML安全标准下的数字签名实现
XML签名包含一个"CanonicalizationMethod"参数用于指定应用于签名的SignedInfo部分所需的规范化算法(canonicalization algorithm)。而实际是XML签名的Apache Santuario XML Security for Java实现允许把任意算法指定给此参数，可被利用对XML签名进行伪造攻击
0
Apache XML Security (Java) 1.5.x
Apache XML Security (Java) 1.4.x
厂商解决方案
Apache XML Security (Java) 1.5.5或1.4.8已经修复此漏洞，建议用户下载更新：
http://santuario.apache.org
Related
redhat
redhat
(RHSA-2013:1217) Moderate: xml-security security update
2013-09-09 00:00:00
(RHSA-2013:1219) Moderate: xml-security security update
2013-09-09 00:00:00
(RHSA-2013:1375) Moderate: Red Hat JBoss BRMS 5.3.1 update
2013-09-30 17:46:18
nessus
nessus
Debian DSA-3065-1 : libxml-security-java - security update
2014-11-07 00:00:00
RHEL 5 / 6 : xml-security in JBoss EWP (RHSA-2013:1219)
2014-06-28 00:00:00
RHEL 5 / 6 : xml-security (RHSA-2013:1217)
2013-09-10 00:00:00
veracode
veracode
Spoofable XML Signature
2019-01-15 08:59:00
ubuntucve
ubuntucve
CVE-2013-2172
2013-08-20 00:00:00
cve
cve
CVE-2013-2172
2013-08-20 22:55:00
debian
debian
[SECURITY] [DSA 3065-1] libxml-security-java security update
2014-11-06 08:45:42
[SECURITY] [DSA 3065-1] libxml-security-java security update
2014-11-06 08:45:42
[SECURITY] [DLA 85-1] libxml-security-java security update
2014-11-09 16:34:59
prion
prion
Code injection
2013-08-20 22:55:00
osv
osv
Inefficient Algorithmic Complexity in Apache Santuario XML Security
2022-05-13 01:05:56
libxml-security-java - security update
2014-11-06 00:00:00
ibm
ibm
securityvulns
securityvulns
[USN-2028-1] Apache XML Security for Java vulnerability
2013-12-09 00:00:00
github
github
Inefficient Algorithmic Complexity in Apache Santuario XML Security
2022-05-13 01:05:56
openvas
openvas
Debian: Security Advisory (DLA-85-1)
2023-03-08 00:00:00
Ubuntu: Security Advisory (USN-2028-1)
2022-08-26 00:00:00
Debian Security Advisory DSA 3065-1 (libxml-security-java - security update)
2014-11-06 00:00:00
mageia
mageia
Updated xml-security package fixes security vulnerability
2014-01-06 04:52:37
debiancve
debiancve
CVE-2013-2172
2013-08-20 22:55:00
ubuntu
ubuntu
Apache XML Security for Java vulnerability
2013-11-12 00:00:00
oracle
oracle
Oracle Critical Patch Update - October 2013
2013-10-15 00:00:00
Oracle Critical Patch Update - July 2014
2014-07-15 00:00:00