veracode-repository-ruleset / verademo-java-maven

verademo-java-maven
0 stars 0 forks source link

CVE: 2021-40690 found in Apache XML Security for Java - Version: 1.5.1 [JAVA] #23

Open github-actions[bot] opened 11 months ago

github-actions[bot] commented 11 months ago

Veracode Software Composition Analysis

Attribute Details
Library Apache XML Security for Java
Description Apache XML Security for Java supports XML-Signature Syntax and Processing, W3C Recommendation 12 February 2002, and XML Encryption Syntax and Processing, W3C Recommendation 10 December 2002. Since ver
Language JAVA
Vulnerability Bypass Of Secure Validation
Vulnerability description Apache Santuario is vulnerable to bypass of secure validation. Lack of secure handling of secureValidation property allows an attacker to abuse an XPath Transform and to extract any local .xml files in a RetrievalMethod element during the creation of a KeyInfo from a KeyInfoReference element.
CVE 2021-40690
CVSS score 5
Vulnerability present in version/s 1.4.5-2.1.6
Found library version/s 1.5.1
Vulnerability fixed in version 2.1.7
Library latest version 4.0.1
Fix

Links:

github-actions[bot] commented 8 months ago

Veracode issue link to PR: https://github.com/veracode-repository-ruleset/verademo-java-maven/pull/54