CVE-2013-2172

EUVD-2022-5065
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
apachesantuario_xml_security_for_java
1.4.7
apachesantuario_xml_security_for_java
1.5.0
apachesantuario_xml_security_for_java
1.5.1
apachesantuario_xml_security_for_java
1.5.2
apachesantuario_xml_security_for_java
1.5.3
apachesantuario_xml_security_for_java
1.5.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libxml-security-java
bookworm
2.1.7-3
fixed
bullseye
2.0.10-2+deb11u1
fixed
bullseye (security)
2.0.10-2+deb11u1
fixed
sid
2.1.8-1
fixed
trixie
2.1.8-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libxml-security-java
lucid
Fixed 1.4.3-2ubuntu0.1
released
precise
Fixed 1.4.5-1+deb7u1build0.12.04.1
released
trusty
dne
utopic
not-affected
vivid
not-affected
Common Weakness Enumeration
References