CVE-2023-44483 Security Details

CVE ID

CVE-2023-44483

CWE

CWE-532

CVE Description

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.

Published

Oct 20, 2023

CVSS Score & Severity

6.5Medium

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

0.173%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/jcp/xml/dsig/internal/dom/DOMRSAPSSSignatureMethod.sign(Ljava/security/Key;Ljavax/xml/crypto/dsig/SignedInfo;Ljavax/xml/crypto/dsig/XMLSignContext;)[B

JVMVulnerable params: 0

org/apache/jcp/xml/dsig/internal/dom/DOMSignatureMethod.sign(Ljava/security/Key;Ljavax/xml/crypto/dsig/SignedInfo;Ljavax/xml/crypto/dsig/XMLSignContext;)[B

JVMVulnerable params: 0

org/jcp/xml/dsig/internal/dom/DOMSignatureMethod.sign(Ljava/security/Key;Lorg/jcp/xml/dsig/internal/dom/DOMSignedInfo;Ljavax/xml/crypto/dsig/XMLSignContext;)[B

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Apache · AnnouncementPROJECT