CVE: 2021-40690 found in Apache XML Security for Java - Version: 1.5.1 [JAVA]

[github-actions[bot]]

Veracode Software Composition Analysis

Attribute	Details
Library	Apache XML Security for Java
Description	Apache XML Security for Java supports XML-Signature Syntax and Processing, W3C Recommendation 12 February 2002, and XML Encryption Syntax and Processing, W3C Recommendation 10 December 2002. As of ver
Language	JAVA
Vulnerability	Bypass Of Secure Validation
Vulnerability description	Apache Santuario is vulnerable to bypass of secure validation. Lack of secure handling of secureValidation property allows an attacker to abuse an XPath Transform and to extract any local .xml files in a RetrievalMethod element during the creation of a KeyInfo from a KeyInfoReference element.
CVE	2021-40690
CVSS score	5
Vulnerability present in version/s	1.4.5-2.1.6
Found library version/s	1.5.1
Vulnerability fixed in version	2.1.7
Library latest version	3.0.1
Fix

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/117?version=1.5.1
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/32164
• Patch: https://github.com/apache/santuario-xml-security-java/commit/c3410a7fbecaa7dca61361d887f801b9e6c66c15

[github-actions[bot]]

Veracode issue link to PR: https://github.com/julz0815/test-action/pull/184