Inclusion of Sensitive Information in Log Files in Apache Santuario XML Security for Java - CVE-2023-44483

Vulnerability identifier: #VU83241

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-44483

CWE-ID: CWE-532

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files when using the JSR 105 API. A remote user can obtain a private key when generating an XML Signature with debug level enabled.

Apache Santuario XML Security for Java
IBM OmniFind Text Search Server for DB2 for i
Red Hat build of Quarkus
IBM Sterling B2B Integrator
IBM Tivoli Netcool Impact
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
Oracle Financial Services Behavior Detection Platform
Oracle Financial Services Model Management and Governance
IBM Transformation Extender Advanced
IBM Process Mining
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Match 360
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Spectrum Control
IBM Global High Availability Mailbox
IBM Tivoli Business Service Manager
IBM Cloud Application Performance Management (APM)
IBM TXSeries for Multiplatforms
IBM Maximo Application Suite
IBM Security Verify Governance
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Observability with Instana
PowerVM NovaLink
Oracle Financial Services Analytical Applications Infrastructure
IBM OpenPages with Watson
IBM Security Verify Bridge for Directory Sync
ObjectScale
IBM Planning Analytics Workspace
IBM Business Automation Manager Open Editions
Storage Protect Operations Center
Maximo Application Suite - Predict Component
Robotic Process Automation for Cloud Pak
Oracle Solaris Cluster
openEuler
Wildfly
JBoss Enterprise Application Platform
Oracle WebLogic Server
IBM WebSphere Application Server Liberty
IBM Tivoli Application Dependency Discovery Manager
Oracle Financial Services Compliance Studio
Oracle Banking Origination
Oracle Banking Cash Management
Oracle Banking Branch
Oracle Banking Virtual Account Management
Oracle Banking Liquidity Management
Communications Service Catalog and Design
Red Hat Single Sign-On
Oracle Outside In Technology
IBM Cognos Controller
IBM License Metric Tool
PeopleSoft Enterprise PeopleTools
Planning Analytics Local
IBM Cognos Analytics
PeopleSoft Enterprise HCM Human Resources
PeopleSoft Enterprise CRM Client Management
Oracle WebCenter Portal
IBM Security Guardium
IBM InfoSphere Information Server
Enterprise Manager for Peoplesoft
Oracle Retail Advanced Inventory Planning
Oracle Communications Cloud Native Core Console
eap7-wildfly-naming-client (Red Hat package)
eap7-jboss-cert-helper (Red Hat package)
eap7-insights-java-client (Red Hat package)
eap7-log4j2-jboss-logmanager (Red Hat package)
eap7-wildfly-transaction-client (Red Hat package)
eap7-jboss-msc (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-xml-security (Red Hat package)
xml-security-javadoc
xml-security
xml-security-demo
eap7-glassfish-jsf (Red Hat package)
eap7-jbossws-spi (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-protostream (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-eclipse-jgit (Red Hat package)
eap7-wildfly (Red Hat package)
rh-sso7-keycloak (Red Hat package)
IBM Cloud Pak System
Red Hat Camel for Spring Boot
IBM CICS TX Advanced
IBM CICS TX Standard
RSA Authentication Manager

Install updates from vendor's website.

Apache Santuario XML Security for Java - addressed in versions 2.2.6, 2.3.4, 3.0.3
PowerVM NovaLink - addressed in versions 2.1.1-240119, 2.2.0-240119
Red Hat build of Quarkus - update to 3.2.10
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
Wildfly - update to 31.0.0
JBoss Enterprise Application Platform - update to 7.4.15
IBM Tivoli Netcool Impact - update to 7.1.0.32
Red Hat Single Sign-On - update to 7.6.7
IBM Cognos Controller - update to 11.0.1.0.3
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 1
IBM WebSphere Application Server Liberty - update to 23.0.0.12
eap7-wildfly-naming-client (Red Hat package) - addressed in versions 1.0.17-1.Final_redhat_00001.1.el7eap, 1.0.17-1.Final_redhat_00001.1.el8eap, 1.0.17-1.Final_redhat_00001.1.el9eap
eap7-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.1-1.redhat_00001.1.el7eap, 1.1.1-1.redhat_00001.1.el8eap, 1.1.1-1.redhat_00001.1.el9eap
eap7-insights-java-client (Red Hat package) - addressed in versions 1.1.1-1.redhat_00001.1.el7eap, 1.1.1-1.redhat_00001.1.el8eap, 1.1.1-1.redhat_00001.1.el9eap
eap7-log4j2-jboss-logmanager (Red Hat package) - addressed in versions 1.1.2-1.Final_redhat_00002.1.el7eap, 1.1.2-1.Final_redhat_00002.1.el8eap, 1.1.2-1.Final_redhat_00002.1.el9eap
eap7-wildfly-transaction-client (Red Hat package) - addressed in versions 1.1.17-1.Final_redhat_00001.1.el7eap, 1.1.17-1.Final_redhat_00001.1.el8eap, 1.1.17-1.Final_redhat_00001.1.el9eap
ObjectScale - update to 1.4.0
eap7-jboss-msc (Red Hat package) - addressed in versions 1.4.13-1.Final_redhat_00001.1.el7eap, 1.4.13-1.Final_redhat_00001.1.el8eap, 1.4.13-1.Final_redhat_00001.1.el9eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.16-1.Final_redhat_00001.1.el7eap, 1.5.16-1.Final_redhat_00001.1.el8eap, 1.5.16-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-34.Final_redhat_00033.1.el7eap, 1.10.0-34.Final_redhat_00033.1.el8eap, 1.10.0-34.Final_redhat_00033.1.el9eap
IBM Process Mining - update to 1.14.3
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.21-1.Final_redhat_00001.1.el7eap, 1.15.21-1.Final_redhat_00001.1.el8eap, 1.15.21-1.Final_redhat_00001.1.el9eap
Planning Analytics Local - update to 2.0.9.20
IBM Planning Analytics Workspace - addressed in versions 2.0.93, 2.1.4
eap7-xml-security (Red Hat package) - addressed in versions 2.2.6-1.redhat_00002.1.el7eap, 2.2.6-1.redhat_00002.1.el8eap, 2.2.6-1.redhat_00002.1.el9eap
IBM Cloud Pak System - update to 2.3.4.0
xml-security-javadoc - update to 2.3.5-1
xml-security - update to 2.3.5-1
xml-security-demo - update to 2.3.5-1
eap7-glassfish-jsf (Red Hat package) - addressed in versions 2.3.14-7.SP08_redhat_00001.1.el7eap, 2.3.14-7.SP08_redhat_00001.1.el8eap, 2.3.14-7.SP08_redhat_00001.1.el9eap
eap7-jbossws-spi (Red Hat package) - addressed in versions 3.4.0-4.Final_redhat_00002.1.el7eap, 3.4.0-4.Final_redhat_00002.1.el8eap, 3.4.0-4.Final_redhat_00002.1.el9eap
eap7-resteasy (Red Hat package) - addressed in versions 3.15.9-1.Final_redhat_00001.1.el7eap, 3.15.9-1.Final_redhat_00001.1.el8eap, 3.15.9-1.Final_redhat_00001.1.el9eap
Red Hat Camel for Spring Boot - update to 3.20.6
eap7-protostream (Red Hat package) - addressed in versions 4.3.6-1.Final_redhat_00001.1.el7eap, 4.3.6-1.Final_redhat_00001.1.el8eap, 4.3.6-1.Final_redhat_00001.1.el9eap
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.2
IBM Match 360 - update to 4.8.3
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
eap7-hibernate (Red Hat package) - addressed in versions 5.3.33-2.Final_redhat_00001.1.el7eap, 5.3.33-2.Final_redhat_00001.1.el8eap, 5.3.33-2.Final_redhat_00001.1.el9eap
IBM Spectrum Control - update to 5.4.12
eap7-eclipse-jgit (Red Hat package) - addressed in versions 5.13.2-1.SP1_redhat_00001.1.el7eap, 5.13.2-1.SP1_redhat_00001.1.el8eap, 5.13.2-1.SP1_redhat_00001.1.el9eap
IBM Global High Availability Mailbox - update to 6.2.0.1
IBM Tivoli Business Service Manager - update to 6.2.0.5.4
eap7-wildfly (Red Hat package) - addressed in versions 7.4.15-2.GA_redhat_00002.1.el7eap, 7.4.15-2.GA_redhat_00002.1.el8eap, 7.4.15-2.GA_redhat_00002.1.el9eap
IBM Business Automation Manager Open Editions - update to 8.0.6
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
Storage Protect Operations Center - update to 8.1.22
IBM TXSeries for Multiplatforms - addressed in versions 8.2.0.3, 9.1.0.3
RSA Authentication Manager - addressed in versions 8.7 SP1 Patch 3, 8.7 SP2 Patch 1
Maximo Application Suite - Predict Component - update to 8.9.1
IBM Maximo Application Suite - addressed in versions 8.10.8, 8.11.5
IBM License Metric Tool - update to 9.2.34
IBM Security Verify Governance - update to 10.0.2.0.3
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix23, 11.1.0.0 ifix16
IBM CICS TX Standard - update to 11.1.0.0 ifix16
IBM Cognos Analytics - addressed in versions 11.2.4 FP4, 12.0.4
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.12-1.redhat_00001.1.el7sso, 18.0.12-1.redhat_00001.1.el8sso, 18.0.12-1.redhat_00001.1.el9sso
IBM Business Automation Workflow - addressed in versions 21.0.3 IF029, 23.0.2 IF002
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.30, 23.0.2.2
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.15, 23.0.16
IBM Observability with Instana - update to 268

• https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55
• http://www.openwall.com/lists/oss-security/2023/10/20/5

• Information disclosure in Apache Santuario XML Security for Java
• IBM WebSphere Application Server Liberty update for Apache Santuario
• IBM Tivoli Netcool Impact update for Apache Santuario
• IBM License Metric Tool update for WebSphere Liberty Profile
• IBM Process Mining update for Apache Santuario
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM OpenPages with Watson
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Communications Service Catalog and Design
• Multiple vulnerabilities in Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
• Multiple vulnerabilities in Oracle Financial Services Behavior Detection Platform
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Inclusion of sensitive information in log files in IBM Tivoli Business Service Manager
• Inclusion of sensitive information in log files in IBM Security Guardium
• WildFly update for third-party components
• Inclusion of sensitive information in log files in IBM TXSeries for Multiplatforms
• Inclusion of sensitive information in log files in IBM CICS TX Standard
• Inclusion of sensitive information in log files in IBM CICS TX Advanced
• Inclusion of sensitive information in log files in Watson Discovery
• Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager
• Inclusion of sensitive information in log files in IBM PowerVM Novalink
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat build of Quarkus 3.2
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 7
• Inclusion of sensitive information in log files in IBM Match 360
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 8
• Inclusion of sensitive information in log files in IBM Maximo Application Suite - Predict Component
• Inclusion of sensitive information in log files in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Transformation Extender Advanced
• Multiple vulnerabilities in IBM Security Verify Directory
• Inclusion of sensitive information in log files in IBM Storage Protect Operations Center
• Multiple vulnerabilities in Oracle Banking Virtual Account Management
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Oracle Banking Cash Management
• Multiple vulnerabilities in Oracle Banking Branch
• Multiple vulnerabilities in PeopleSoft Enterprise CRM Client Management
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 3.20
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in Planning Analytics Local
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Inclusion of Sensitive Information in Log Files in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Inclusion of Sensitive Information in Log Files in Enterprise Manager for Peoplesoft
• Multiple vulnerabilities in Oracle Solaris Cluster
• Multiple vulnerabilities in IBM Cognos Analytics
• IBM B2B Sterling integrator update for Apache Santuario
• IBM Sterling Global High Availability Mailbox update for Apache Santuario
• Multiple vulnerabilities in IBM Cognos Controller
• Inclusion of Sensitive Information in Log Files in Oracle Outside In Technology
• Multiple vulnerabilities in Oracle Financial Services Compliance Studio
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• RSA Authentication Manager update for third-party components
• Inclusion of Sensitive Information in Log Files in PeopleSoft Enterprise HCM Human Resources
• Multiple vulnerabilities in IBM InfoSphere Information Server
• openEuler 22.03 LTS SP3 update for xml-security
• openEuler 20.03 LTS SP4 update for xml-security
• openEuler 24.03 LTS SP2 update for xml-security
• openEuler 24.03 LTS SP1 update for xml-security
• openEuler 24.03 LTS update for xml-security
• openEuler 22.03 LTS SP4 update for xml-security
• Inclusion of Sensitive Information in Log Files in Oracle Retail Advanced Inventory Planning
• Multiple vulnerabilities in IBM OmniFind Text Search Server for DB2 for i