CVE-2013-5823
Apache XML Security For Java vulnerable to Infinite Loop
Résumé
Apache XML Security For Java vulnerable to Infinite Loop
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Affected versions of xmlsec are subject to a denial of service vulnerability. Should a user check the signature of a message larger than 512 MB, the method expandSize(int newPos) of class org.apache.xml.security.utils.UnsyncByteArrayOutputStream goes in an endless loop. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Maven
org.apache.santuario:xmlsec
[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.3"}]}]
Références
- advisory nvd.nist.gov
- web github.com
- web github.com
- web github.com
- web access.redhat.com
- web bugzilla.redhat.com
- web issues.apache.org
- web lists.opensuse.org
- web marc.info
- web marc.info
- web security.gentoo.org