{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:53a4dc97-a39c-5595-946a-5ead1dc797e8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "xmlsec", "purl": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.1", "type": "library", "group": "org.apache.santuario", "bom-ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.1", "version": "2.1.4-tuxcare.1", "pedigree": { "ancestors": [ { "name": "xmlsec", "purl": "pkg:maven/org.apache.santuario/xmlsec@2.1.4", "type": "library", "group": "org.apache.santuario", "version": "2.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-0217", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.1" } ], "bom-ref": "urn:uuid:d8407ca4-b62f-5d6d-9fd4-a3dfc76ab417", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-0217 does not affect version 2.1.4-tuxcare.1 of org.apache.santuario:xmlsec. not_affected \u2014 Apache Santuario XML Security for Java version 2.1.4 contains the fix for CVE-2009-0217. The vulnerability allowed attackers to bypass HMAC-based XML Signature authentication by specifying dangerously short truncation lengths (HMACOutputLength parameter). The target repository validates HMACOutputLength in both DOM and StAX implementations: DOM implementations explicitly reject values below the...", "justification": "code_not_present" } }, { "id": "CVE-2013-2172", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.1" } ], "bom-ref": "urn:uuid:ac6e1b1c-0392-5f52-ace3-1af2b2cff602", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-2172 does not affect version 2.1.4-tuxcare.1 of org.apache.santuario:xmlsec. not_affected \u2014 CVE-2013-2172 is not present in this target. The vulnerability allowed attackers to spoof XML signatures by specifying weak canonicalization algorithms. The upstream fix (commit cd1bc640, 2013-06-17) added whitelist validation to DOMCanonicalizationMethod constructors, rejecting non-standard canonicalization methods. This fix was already present in upstream version 2.1.4 (released 2019-07-16) w...", "justification": "code_not_present" } }, { "id": "CVE-2013-4517", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.1" } ], "bom-ref": "urn:uuid:e49a6ce7-3baf-51d3-b7d1-9b841bbc9cc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-4517 does not affect version 2.1.4-tuxcare.1 of org.apache.santuario:xmlsec. not_affected \u2014 CVE-2013-4517 affects Apache Santuario XML Security for Java versions before 1.5.6. The target repository is at version 2.1.4-tuxcare.1, which is based on upstream version 2.1.4 (released in 2019). The DTD-blocking defense introduced to fix CVE-2013-4517 was already present in the upstream 1.5.6 release (November 2013), long before version 2.1.4. TuxCare onboarded version 2.1.4 which already co...", "justification": "code_not_present" } }, { "id": "CVE-2013-5823", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.1" } ], "bom-ref": "urn:uuid:10acead2-4f16-52ec-9b12-ad4ec6a11e80", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-5823 does not affect version 2.1.4-tuxcare.1 of org.apache.santuario:xmlsec. not_affected \u2014 CVE-2013-5823 affects UnsyncByteArrayOutputStream.expandSize() which could enter an infinite loop due to integer overflow when processing messages larger than 512 MB. The target repository version 2.1.4-tuxcare.1 is NOT AFFECTED because the vulnerability pattern is not present. The fix was applied by upstream Apache in commit 603e3569 (dated July 2012) and shipped in upstream release 2.1.4, whi...", "justification": "code_not_present" } }, { "id": "CVE-2014-8152", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.1" } ], "bom-ref": "urn:uuid:c0f74177-00e1-5af7-b3ea-ddecbb1053fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-8152 does not affect version 2.1.4-tuxcare.1 of org.apache.santuario:xmlsec. not_affected \u2014 CVE-2014-8152 describes a vulnerability in Apache Santuario XML Security for Java 2.0.x before 2.0.3 where attackers could bypass streaming XML signature verification via a crafted XML document. The target version 2.1.4-tuxcare.1 already includes the upstream fix (commit 3d7086c6 by Marc Giger ) that was shipped in version 2.0.3 and inherited by all later versions including 2....", "justification": "code_not_present" } }, { "id": "CVE-2019-12400", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.1" } ], "bom-ref": "urn:uuid:c0a58d2c-3322-58ad-b651-d6aa43599c83", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-12400 does not affect version 2.1.4-tuxcare.1 of org.apache.santuario:xmlsec. not_affected \u2014 Target version 2.1.4-tuxcare.1 is not affected by CVE-2019-12400. The vulnerability was fixed in upstream version 2.1.4, which TuxCare onboarded. The fix replaced the vulnerable global static DocumentBuilder pool with ClassLoader-isolated caches using WeakHashMap>, preventing malicious parser instances from one security context being reused in another. The CV...", "justification": "code_not_present" } }, { "id": "CVE-2021-40690", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.1" } ], "bom-ref": "urn:uuid:9f48bd52-884c-5b25-b61a-a6c119fac6e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-40690 affects version 2.1.4-tuxcare.1 of org.apache.santuario:xmlsec, and is fixed in 2.1.4-tuxcare.2." } }, { "id": "CVE-2023-44483", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.1" } ], "bom-ref": "urn:uuid:72e8e381-0955-5243-b3db-f5c8c18bb811", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44483 affects version 2.1.4-tuxcare.1 of org.apache.santuario:xmlsec." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.1" } ] }