CVE-2014-8152 Improper Input Validation in Apache Santuario XML Security
Remote attackers can bypass XML signature protection in Apache Santuario via crafted documents, requiring library upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-8152?
CVE-2014-8152 is a medium-severity vulnerability in n/a, published on 21 Jan 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
Weakness: CWE-254
Which versions are affected by CVE-2014-8152?
2 open source packages ship an affected version, including org.apache.santuario:xmlsec. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.santuario:xmlsec Maven | From 2.0.0 | 2.0.3 |
org.apache.santuario:xmlsec Maven | From 2.0.0 | 2.0.3 |
Products include Apache Santuario Xml Security for Java.
How do I fix CVE-2014-8152?
Upgrade org.apache.santuario:xmlsec to 2.0.3 or later.
Is CVE-2014-8152 being exploited?
There is no known exploitation of CVE-2014-8152 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-44483 Apache Santuario: Private Key disclosure in debug-log output
- CVE-2019-12400 Improper input validation in Apache Santuario XML Security for Java
- CVE-2013-4517 Improper Input Validation in Apache Santuario XML Security
- CVE-2013-2172 Inefficient Algorithmic Complexity in Apache Santuario XML Security
Sources
Also known as GHSA-w7cq-j9p9-hm3m.