CVE-2019-12400 Improper input validation in Apache Santuario XML Security for Java
Attackers can inject malicious code via thread context class loader caching, compromising XML document validation in Apache Santuario.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-12400?
CVE-2019-12400 is a medium-severity code injection vulnerability in Oracle Weblogic Server, published on 23 Aug 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.
Weakness: CWE-20
Which versions are affected by CVE-2019-12400?
2 open source packages ship an affected version, including org.apache.santuario:xmlsec. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.santuario:xmlsec Maven | From 2.0.3 | 2.1.4 |
org.apache.santuario:xmlsec Maven | From 2.0.3 | 2.1.4 |
Products include Apache Santuario Xml Security for Java, Oracle Weblogic Server, Redhat Jboss Enterprise Application Platform.
How do I fix CVE-2019-12400?
Upgrade org.apache.santuario:xmlsec to 2.1.4 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-12400 being exploited?
There is no known exploitation of CVE-2019-12400 in the wild and no public exploit code.
Other vulnerabilities in Oracle Weblogic Server
- CVE-2023-44483 Apache Santuario: Private Key disclosure in debug-log output
- CVE-2014-8152 Improper Input Validation in Apache Santuario XML Security
- CVE-2013-4517 Improper Input Validation in Apache Santuario XML Security
- CVE-2013-2172 Inefficient Algorithmic Complexity in Apache Santuario XML Security
Sources
Also known as DEBIAN-CVE-2019-12400, GHSA-4q98-wr72-h35w, UBUNTU-CVE-2019-12400.