// For flags

CVE-2019-12400

xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source

Severity Score

5.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.

En la versión 2.0.3 Apache Santuario XML Security para Java, se introdujo un mecanismo de almacenamiento en caché para acelerar la creación de nuevos documentos XML utilizando un grupo estático de DocumentBuilders. Sin embargo, si algún código no confiable puede registrar una implementación maliciosa con el cargador de clases de contexto de subprocesos primero, entonces esta implementación podría ser almacenada en caché y reutilizada por Apache Santuario - XML ??Security para Java, lo que podría generar posibles fallas de seguridad al validar documentos firmados, etc. La vulnerabilidad afecta a Apache Santuario - XML ??Security para las versiones Java 2.0.x de 2.0.3 y todas las versiones 2.1.x anteriores a 2.1.4.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Local
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-05-28 CVE Reserved
  • 2019-08-23 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-08-16 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
References (16)
URL Tag Source
https://lists.apache.org/thread.html/8e814b925bf580bc527d96ff51e72ffe5bdeaa4b8bf5b89498cab24c%40%3Cdev.santuario.apache.org%3E Mailing List
https://lists.apache.org/thread.html/edaa7edb9c58e5f5bd0c950f2b6232b62b15f5c44ad803e8728308ce%40%3Cdev.santuario.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r107bffb06a5e27457fe9af7dfe3a233d0d36c6c2f5122f117eb7f626%40%3Ccommits.tomee.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rcdc0da94fe21b26493eae47ca987a290bdf90c721a7a42491fdd41d4%40%3Ccommits.tomee.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rf82be0a7c98cd3545e20817bb96ed05551ea0020acbaf9a469fef402%40%3Ccommits.tomee.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rf958cea96236de8829940109ae07e870aa3d59235345421e4924ff03%40%3Ccommits.tomee.apache.org%3E Mailing List
https://security.netapp.com/advisory/ntap-20190910-0003 Third Party Advisory
URL Date SRC
URL Date SRC
https://www.oracle.com/security-alerts/cpuoct2021.html 2023-11-07
URL Date SRC
http://santuario.apache.org/secadv.data/CVE-2019-12400.asc?version=1&modificationDate=1566573083000&api=v2 2023-11-07
https://access.redhat.com/errata/RHSA-2020:0804 2023-11-07
https://access.redhat.com/errata/RHSA-2020:0805 2023-11-07
https://access.redhat.com/errata/RHSA-2020:0806 2023-11-07
https://access.redhat.com/errata/RHSA-2020:0811 2023-11-07
https://access.redhat.com/security/cve/CVE-2019-12400 2020-07-28
https://bugzilla.redhat.com/show_bug.cgi?id=1764658 2020-07-28
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Santuario Xml Security For Java
Search vendor "Apache" for product "Santuario Xml Security For Java"
 >= 2.0.3 <= 2.0.10
Search vendor "Apache" for product "Santuario Xml Security For Java" and version " >= 2.0.3 <= 2.0.10"
-
Affected
Apache
Search vendor "Apache"
 Santuario Xml Security For Java
Search vendor "Apache" for product "Santuario Xml Security For Java"
 >= 2.1.0 < 2.1.4
Search vendor "Apache" for product "Santuario Xml Security For Java" and version " >= 2.1.0 < 2.1.4"
-
Affected
Redhat
Search vendor "Redhat"
 Jboss Enterprise Application Platform
Search vendor "Redhat" for product "Jboss Enterprise Application Platform"
 7.2
Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.2"
-
Affected
Oracle
Search vendor "Oracle"
 Weblogic Server
Search vendor "Oracle" for product "Weblogic Server"
 12.2.1.4.0
Search vendor "Oracle" for product "Weblogic Server" and version "12.2.1.4.0"
-
Affected
Oracle
Search vendor "Oracle"
 Weblogic Server
Search vendor "Oracle" for product "Weblogic Server"
 14.1.1.0.0
Search vendor "Oracle" for product "Weblogic Server" and version "14.1.1.0.0"
-
Affected