~ / search / GHSA-8gwc-x7mg-7p7p

GHSA-8gwc-x7mg-7p7p

Apache XML Security For Java vulnerable to Infinite Loop

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-5823

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.santuario:xmlsec >= 1.4.0, < 1.4.8 1.4.8
Maven org.apache.santuario:xmlsec >= 1.5.0, < 1.5.3 1.5.3

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of xmlsec are subject to a denial of service vulnerability. Should a user check the signature of a message larger than 512 MB, the method `expandSize(int newPos)` of class `org.apache.xml.security.utils.UnsyncByteArrayOutputStream` goes in an endless loop. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service.

References

External links from the advisory. They lead to third-party sites.