SB2013082106 - Improper verification of cryptographic signature in Apache Santuario XML Security for Java

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2013082106

SB2013082106 - Improper verification of cryptographic signature in Apache Santuario XML Security for Java

Published: August 21, 2013 Updated: March 13, 2023

Security Bulletin ID SB2013082106
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper verification of cryptographic signature (CVE-ID: CVE-2013-2172)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper verification of signature in jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java. A remote attacker can spoof the XML signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature".


Remediation

Install update from vendor's website.

References