Inefficient Algorithmic Complexity in Apache Santuario XML Security
Date: 2022-05
Affected: maven/org.apache.santuario:xmlsec, maven/org.apache.santuario:xmlsec
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2013-2172
CVE-2013-4517
CVE-2014-8152
CWE: CWE-20
CWE-407
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

`jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java` in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."


Mitigations:

Architectural layers (MAESTRO):