Apache Santuario 'XML Signature Verification' Security Bypass Vulnerability

Bugtraq ID:	72115
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2014-8152
Remote:	Yes
Local:	No
Published:	Jan 19 2015 12:00AM
Updated:	Jan 19 2015 12:00AM
Credit:	Apache
Vulnerable:
Not Vulnerable:

Apache Santuario 'XML Signature Verification' Security Bypass Vulnerability

Apache Santuario is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks.

Apache Santuario 2.0.x versions prior to 2.0.3 are vulnerable.

Apache Santuario 'XML Signature Verification' Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Santuario 'XML Signature Verification' Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Santuario 'XML Signature Verification' Security Bypass Vulnerability

References:

• Apache Santuario Homepage (Apache Software Foundation)
  
• CVE-2014-8152: Streaming XML Signature verification failure (Apache)