XML Parsing Vulnerability in Apache Santuario XML Security for Java

CVE-2019-12400

What is CVE-2019-12400?

In versions of Apache Santuario XML Security for Java starting from 2.0.3, a caching mechanism was implemented to optimize the creation of new XML documents using a static pool of DocumentBuilders. However, this mechanism is susceptible to risks if untrusted code registers a harmful implementation with the thread context class loader. Consequently, the cached implementation may be reused by the library, leading to potential security issues, particularly during the validation of signed documents. Versions affected by this vulnerability include 2.0.x from 2.0.3 and all 2.1.x releases prior to version 2.1.4.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References