{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:be25968c-15ad-5f4e-845a-7fb06c3fc29a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "xmlsec", "purl": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.2", "type": "library", "group": "org.apache.santuario", "bom-ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.2", "version": "2.1.4-tuxcare.2", "pedigree": { "ancestors": [ { "name": "xmlsec", "purl": "pkg:maven/org.apache.santuario/xmlsec@2.1.4", "type": "library", "group": "org.apache.santuario", "version": "2.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-0217", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.2" } ], "bom-ref": "urn:uuid:738f24de-554b-5d82-a4d7-9d724f6255ef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-0217 does not affect version 2.1.4-tuxcare.2 of org.apache.santuario:xmlsec. not_affected \u2014 Apache Santuario XML Security for Java version 2.1.4 contains the fix for CVE-2009-0217. The vulnerability allowed attackers to bypass HMAC-based XML Signature authentication by specifying dangerously short truncation lengths (HMACOutputLength parameter). The target repository validates HMACOutputLength in both DOM and StAX implementations: DOM implementations explicitly reject values below the...", "justification": "code_not_present" } }, { "id": "CVE-2013-2172", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.2" } ], "bom-ref": "urn:uuid:08a9cf49-c8e5-5151-b274-385fc80e05a3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-2172 does not affect version 2.1.4-tuxcare.2 of org.apache.santuario:xmlsec. not_affected \u2014 CVE-2013-2172 is not present in this target. The vulnerability allowed attackers to spoof XML signatures by specifying weak canonicalization algorithms. The upstream fix (commit cd1bc640, 2013-06-17) added whitelist validation to DOMCanonicalizationMethod constructors, rejecting non-standard canonicalization methods. This fix was already present in upstream version 2.1.4 (released 2019-07-16) w...", "justification": "code_not_present" } }, { "id": "CVE-2013-4517", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.2" } ], "bom-ref": "urn:uuid:cbb11bb5-2fb5-5689-ba57-ae95ca5c001f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-4517 does not affect version 2.1.4-tuxcare.2 of org.apache.santuario:xmlsec. not_affected \u2014 CVE-2013-4517 affects Apache Santuario XML Security for Java versions before 1.5.6. The target repository is at version 2.1.4-tuxcare.1, which is based on upstream version 2.1.4 (released in 2019). The DTD-blocking defense introduced to fix CVE-2013-4517 was already present in the upstream 1.5.6 release (November 2013), long before version 2.1.4. TuxCare onboarded version 2.1.4 which already co...", "justification": "code_not_present" } }, { "id": "CVE-2013-5823", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.2" } ], "bom-ref": "urn:uuid:773145f6-43f8-5a5e-912b-4d8328a52a4f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-5823 does not affect version 2.1.4-tuxcare.2 of org.apache.santuario:xmlsec. not_affected \u2014 CVE-2013-5823 affects UnsyncByteArrayOutputStream.expandSize() which could enter an infinite loop due to integer overflow when processing messages larger than 512 MB. The target repository version 2.1.4-tuxcare.1 is NOT AFFECTED because the vulnerability pattern is not present. The fix was applied by upstream Apache in commit 603e3569 (dated July 2012) and shipped in upstream release 2.1.4, whi...", "justification": "code_not_present" } }, { "id": "CVE-2014-8152", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.2" } ], "bom-ref": "urn:uuid:a27dfb5a-802f-5862-8910-4e23e863104b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-8152 does not affect version 2.1.4-tuxcare.2 of org.apache.santuario:xmlsec. not_affected \u2014 CVE-2014-8152 describes a vulnerability in Apache Santuario XML Security for Java 2.0.x before 2.0.3 where attackers could bypass streaming XML signature verification via a crafted XML document. The target version 2.1.4-tuxcare.1 already includes the upstream fix (commit 3d7086c6 by Marc Giger ) that was shipped in version 2.0.3 and inherited by all later versions including 2....", "justification": "code_not_present" } }, { "id": "CVE-2019-12400", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.2" } ], "bom-ref": "urn:uuid:90f511f3-0c57-52d3-931c-cb7399262964", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-12400 does not affect version 2.1.4-tuxcare.2 of org.apache.santuario:xmlsec. not_affected \u2014 Target version 2.1.4-tuxcare.1 is not affected by CVE-2019-12400. The vulnerability was fixed in upstream version 2.1.4, which TuxCare onboarded. The fix replaced the vulnerable global static DocumentBuilder pool with ClassLoader-isolated caches using WeakHashMap>, preventing malicious parser instances from one security context being reused in another. The CV...", "justification": "code_not_present" } }, { "id": "CVE-2021-40690", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.2" } ], "bom-ref": "urn:uuid:a939d0e7-eb53-5402-ad06-fbfd8fbf947f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-40690 is fixed in version 2.1.4-tuxcare.2 of org.apache.santuario:xmlsec." } }, { "id": "CVE-2023-44483", "affects": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.2" } ], "bom-ref": "urn:uuid:556674ca-2137-55df-b85d-8784e35329e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44483 affects version 2.1.4-tuxcare.2 of org.apache.santuario:xmlsec." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.santuario/xmlsec@2.1.4-tuxcare.2" } ] }