Vulnetix
Try Vulnetix Request Demo
CVE-2019-12400 PUBLISHED

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.

EPSS 0.59% · 68.9th percentile

Risk Scores

EPSS Score
0.59%
68.9th percentile

Affected Products

VendorProductVersions
Ubuntu:20.04:LTSlibxml-security-java0, 2.0.10-2+deb11u1build0.20.04.1, 2.0.10-2
Ubuntu:16.04:LTSlibxml-security-java1.5.6-1, 0
Ubuntu:18.04:LTSlibxml-security-java2.0.10-2~18.04, 1.5.8-2, 0

Timeline

References

Open in Interactive Console →