CVE-2019-12400

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.

References

Affected packages

Git / github.com/apache/santuario-xml-security-java

Affected ranges

Type

GIT

Repo

https://github.com/apache/santuario-xml-security-java

Events

Introduced

66186fe7e6ebc1ac4d33e4394204eac8c751e871

Last affected

3ac977e36428158400957f4cefb291d7290356e7

Introduced

003ed791f9b5d729c101aae40699afef2acf0f6c

Fixed

9c3e16017483d4590b4235b8d27cf340cf36eecd

Database specific

{
    "versions": [
        {
            "introduced": "2.0.3"
        },
        {
            "last_affected": "2.0.10"
        },
        {
            "introduced": "2.1.0"
        },
        {
            "fixed": "2.1.4"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12400.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.2.1.4.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "14.1.1.0.0"
            }
        ]
    }
]