# org.apache.santuario:xmlsec (Maven) vulnerabilities

8 known vulnerabilities, with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.apache.santuario/xmlsec

## Advisories (8)

### [CVE-2023-44483](https://cve.now/CVE-2023-44483): Apache Santuario: Private Key disclosure in debug-log output

- Severity: Unrated
- Published: Oct 20, 2023
- Affected: from 2.3.0, fixed in 2.3.4; fixed in 2.2.6; from 3.0.0, fixed in 3.0.3.

### [CVE-2021-40690](https://cve.now/CVE-2021-40690): Bypass of the secureValidation property

- Severity: Unrated
- Published: Sep 19, 2021
- Affected: from 2.2.0, fixed in 2.2.3; fixed in 2.1.7.

### [CVE-2019-12400](https://cve.now/CVE-2019-12400): In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a…

- Severity: Unrated
- Published: Aug 23, 2019
- Affected: from 2.0.3, fixed in 2.1.4.

### [CVE-2014-8152](https://cve.now/CVE-2014-8152): Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection…

- Severity: Unrated
- Published: Jan 21, 2015
- Affected: from 2.0.0, fixed in 2.0.3.

### [CVE-2013-4517](https://cve.now/CVE-2013-4517): Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service…

- Severity: Unrated
- Published: Jan 11, 2014
- Affected: fixed in 1.5.6.

### [CVE-2013-5823](https://cve.now/CVE-2013-5823): Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and…

- Severity: Unrated
- Published: Oct 16, 2013
- Affected: from 1.4.0, fixed in 1.4.8; from 1.5.0, fixed in 1.5.3.

### [CVE-2013-2172](https://cve.now/CVE-2013-2172): jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before…

- Severity: Unrated
- Published: Aug 20, 2013
- Affected: from 1.4.0, fixed in 1.4.8; from 1.5.0, fixed in 1.5.5.

### [CVE-2009-0217](https://cve.now/CVE-2009-0217): The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle…

- Severity: Unrated
- Published: Jul 14, 2009
- Affected: from 1.4.0, fixed in 1.4.3.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.santuario:xmlsec
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.