Most recent entries from all

bdu:2020-00197

EUVD-2026-55016

fkie_cve-2019-12400

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.

GHSA-4q98-wr72-h35w — Improper input validation in Apache Santuario XML Security for Java

Affected: Maven: org.apache.santuario:xmlsec

gsd-2019-12400

openSUSE-SU-2024:11693-1 — xml-security-2.1.7-1.1 on GA media

xml-security-2.1.7-1.1 on GA media

RHSA-2020:0804 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 6 security update

thrift: Endless loop when feed with specific input data thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use netty: HTTP request smuggling netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling

UBUNTU-CVE-2019-12400

Affected: Ubuntu:16.04:LTS: libxml-security-java, Ubuntu:18.04:LTS: libxml-security-java, Ubuntu:20.04:LTS: libxml-security-java