CVE-2019-12400

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.

Published: Aug 23, 2019
Updated: Nov 8, 2023
CVE: CVE-2019-12400
GHSA: GHSA-4q98-wr72-h35w
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.5
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v2:

Severity: Low
Score: 1.9
AV:L/AC:M/Au:N/C:N/I:P/A:N

CWEs:

CWE-20

Affected Software
References

Software	From	Fixed in
apache / santuario_xml_security_for_java	2.1.0	2.1.4
apache / santuario_xml_security_for_java	2.0.3	2.0.10.x
redhat / jboss_enterprise_application_platform	7.2	7.2.x
oracle / weblogic_server	12.2.1.4.0	12.2.1.4.0.x
oracle / weblogic_server	14.1.1.0.0	14.1.1.0.0.x
org.apache.santuario / xmlsec	2.0.3	2.1.4

Vulnerability Database

289,599

CVE-2019-12400