CVE-2013-5823
Apache XML Security For Java vulnerable to Infinite Loop
Summary
Apache XML Security For Java vulnerable to Infinite Loop
Original description
The description as published by the source.
Affected versions of xmlsec are subject to a denial of service vulnerability. Should a user check the signature of a message larger than 512 MB, the method expandSize(int newPos) of class org.apache.xml.security.utils.UnsyncByteArrayOutputStream goes in an endless loop. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Maven
org.apache.santuario:xmlsec
[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.3"}]}]
References
- advisory nvd.nist.gov
- web github.com
- web github.com
- web github.com
- web access.redhat.com
- web bugzilla.redhat.com
- web issues.apache.org
- web lists.opensuse.org
- web marc.info
- web marc.info
- web security.gentoo.org