Red Hat Security Advisory 2013-1217-01 - Apache Santuario implements the XML Signature Syntax and Processing and XML Encryption Syntax and Processing standards. A flaw was found in the way Apache Santuario XML Security for Java validated XML signatures. Santuario allowed a signature to specify an arbitrary canonicalization algorithm, which would be applied to the SignedInfo XML fragment. A remote attacker could exploit this to spoof an XML signature via a specially-crafted XML signature block.
59e7da5d79addbf6d0e2afd386dbf5d968a3902d09a2c111b3eee38b33e88794