CVE-2013-2172 Inefficient Algorithmic Complexity in Apache Santuario XML Security

Medium 4.3 Published 20 Aug 2013 Updated 6 Aug 2024

Attackers can spoof XML signatures by specifying weak canonicalization algorithms, bypassing security checks in Apache Santuario XML Security for Java.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-2172?

CVE-2013-2172 is a medium-severity vulnerability in n/a, published on 20 Aug 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."

Weakness: CWE-310

Which versions are affected by CVE-2013-2172?

4 open source packages ship an affected version, including org.apache.santuario:xmlsec. It affects 1 product.

Package	Affected	Fixed in
`org.apache.santuario:xmlsec` Maven	From `1.4.0`	`1.4.8`
`org.apache.santuario:xmlsec` Maven	From `1.4.0`	`1.4.8`
`org.apache.santuario:xmlsec` Maven	From `1.5.0`	`1.5.5`
`org.apache.santuario:xmlsec` Maven	From `1.5.0`	`1.5.5`

Linux distribution packages (5)

`xml-security` Red Hat:jboss_enterprise_application_platform:5::el4	All versions	`0:1.5.1-3_patch01.ep5.el4`
`xml-security` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:1.5.1-3_patch01.ep5.el5`
`xml-security` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:1.5.1-3_patch01.ep5.el6`
`xml-security` Red Hat:jboss_enterprise_web_platform:5::el5	All versions	`0:1.5.1-3_patch01.ep5.el5`
`xml-security` Red Hat:jboss_enterprise_web_platform:5::el6	All versions	`0:1.5.1-3_patch01.ep5.el6`

Products include Apache Santuario Xml Security for Java.

How do I fix CVE-2013-2172?

Upgrade org.apache.santuario:xmlsec to a fixed version for your release line: 1.4.8 or 1.5.5.

Is CVE-2013-2172 being exploited?

There is no known exploitation of CVE-2013-2172 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2013-2172, DLA-85-1, DSA-3065-1, GHSA-r237-w2w6-jq3p, MGASA-2014-0002, RHSA-2013:1217 and 1 more.