The Apache Santuario XML Security for Java project is vulnerable to a Denial of Service (DoS) type attack leading to an OutOfMemoryError, which is caused by allowing Document Type Definitions (DTDs) when applying Transforms. From the 1.5.6 release onwards, DTDs will not be processed at all when the "secure validation" mode is enabled.
8718e8b28ba92f0c8d1021a89a00f91b0c89c346b43d6b5dba5031eb339cb16c
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2013-4517: Java XML Signature DoS Attack
Severity: Major
Vendor: The Apache Software Foundation
Versions Affected:
This vulnerability affects all released versions of Apache Santuario XML
Security for Java.
Description:
The Apache Santuario XML Security for Java project is vulnerable to a Denial
of Service (DoS) type attack leading to an OutOfMemoryError, which is caused
by allowing Document Type Definitions (DTDs) when applying Transforms. From
the 1.5.6 release onwards, DTDs will not be processed at all when the "secure
validation" mode is enabled. For more information on the secure validation
property, please refer to the FAQ:
http://santuario.apache.org/faq.html
This has been fixed in revision:
http://svn.apache.org/viewvc?view=revision&revision=1537956
Migration:
1.4.x users should upgrade to 1.5.6 as soon as possible.
1.5.x users should upgrade to 1.5.6 as soon as possible.
Credit: This issue was reported by James Forshaw, Context Information Security
References: http://santuario.apache.org/secadv.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQEcBAEBAgAGBQJSrt36AAoJEGe/gLEK1TmD8Q4H/iIeLW+vU7AOAztwT6XMaDaa
ogDeWbJYmEbUc2kRRM1v7Re6CgMgvV9JYM4yr03WH/0EUo9jWJIwsupUlLQKUvLG
tXPXqbdANxBOVkUOwPvuVxIywvbusNFwOSNJ60mj02Nfg0EVtzRH926Tyt5+Dvcc
eXrMK1tVneGxpX95BrDyrt6S9xF2/hIdUQxoEKGiKWwm7ZahJwVMWFXmJ24Pnutj
InkZGKAo+2zResFnm3n5NM+FLlQymovqVtIj6Xcvx3KZT2Gsz7UO7lqqNiAYtxgO
c7wdFH1/cJs5n1BneQdotvvgdpzrVpqQP3RIzd6RgTqrofq8gUQkbQOzmWeq0Oc=
=a4zt
-----END PGP SIGNATURE-----