https://bugzilla.redhat.com/show_bug.cgi?id=1764658
Bug ID: 1764658
Summary: CVE-2019-12400 xml-security: Apache Santuario
potentially loads XML parsing code from an untrusted
source
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: agrimm(a)gmail.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bgeorges(a)redhat.com, bmaxwell(a)redhat.com,
brian.stansberry(a)redhat.com, caolanm(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, etirelli(a)redhat.com,
extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com,
gvarsami(a)redhat.com, ibek(a)redhat.com,
i.gnatenko.brain(a)gmail.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jcoleman(a)redhat.com, jhrozek(a)redhat.com,
jochrist(a)redhat.com, jolee(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, loleary(a)redhat.com, lthon(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, mszynkie(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgallagh(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
puntogil(a)libero.it, rguimara(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sdaley(a)redhat.com,
smaestri(a)redhat.com, spinder(a)redhat.com,
ssorce(a)redhat.com, sthorger(a)redhat.com,
tcunning(a)redhat.com, theute(a)redhat.com,
tkirby(a)redhat.com, tom.jenkinson(a)redhat.com,
trogers(a)redhat.com, twalsh(a)redhat.com,
veillard(a)redhat.com, vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism
was introduced to speed up creating new XML documents using a static pool of
DocumentBuilders. However, if some untrusted code can register a malicious
implementation with the thread context class loader first, then this
implementation might be cached and re-used by Apache Santuario - XML Security
for Java, leading to potential security flaws when validating signed documents,
etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x
releases from 2.0.3 and all 2.1.x releases before 2.1.4.
References:
http://santuario.apache.org/secadv.data/CVE-2019-12400.asc?version=1&...
https://lists.apache.org/thread.html/8e814b925bf580bc527d96ff51e72ffe5bde...
https://lists.apache.org/thread.html/edaa7edb9c58e5f5bd0c950f2b6232b62b15...
https://security.netapp.com/advisory/ntap-20190910-0003/
--
You are receiving this mail because:
You are on the CC list for the bug.