Описание
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.5.5-2 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was not-affected [1.5.5-2]] |
| lucid | released | 1.4.3-2ubuntu0.1 |
| precise | released | 1.4.5-1+deb7u1build0.12.04.1 |
| trusty | not-affected | 1.5.5-2 |
| trusty/esm | DNE | trusty was not-affected [1.5.5-2] |
| upstream | released | 1.4.8, 1.5.5 |
| utopic | not-affected | 1.5.5-2 |
| vivid | not-affected | 1.5.5-2 |
Показывать по
EPSS
4.3 Medium
CVSS2
Связанные уязвимости
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache San ...
Inefficient Algorithmic Complexity in Apache Santuario XML Security
Уязвимость компонента jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java платформы для обеспечения стандартов безопасности для XML Apache Santuario XML Security for Java, позволяющая нарушителю подменить XML-подпись
EPSS
4.3 Medium
CVSS2