CVE-2021-40690

NameCVE-2021-40690
DescriptionAll versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2767-1, DSA-5010-1
Debian Bugs994569

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libxml-security-java (PTS)bullseye (security), bullseye2.0.10-2+deb11u1fixed
bookworm2.1.7-3fixed
sid, trixie2.1.8-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libxml-security-javasourcestretch1.5.8-2+deb9u1DLA-2767-1
libxml-security-javasourcebuster2.0.10-2+deb10u1DSA-5010-1
libxml-security-javasourcebullseye2.0.10-2+deb11u1DSA-5010-1
libxml-security-javasource(unstable)2.1.7-1994569

Notes

https://santuario.apache.org/secadv.data/CVE-2021-40690.txt.asc
Search for package or bug name: Reporting problems