Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.santuario/xmlsec@1.4-alpha0
Typemaven
Namespaceorg.apache.santuario
Namexmlsec
Version1.4-alpha0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version1.4.3
Latest_non_vulnerable_version3.0.3
Affected_by_vulnerabilities
0
url VCID-a43t-774n-kbb7
vulnerability_id VCID-a43t-774n-kbb7
summary 
UnsyncByteArrayOutputStream Denial of Service
This package allows remote attackers to affect availability via unknown vectors related to Security.
references
0
reference_url http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/a7758faab30d
reference_id
reference_type
scores
url http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/a7758faab30d
1
reference_url https://issues.apache.org/jira/browse/SANTUARIO-334
reference_id
reference_type
scores
url https://issues.apache.org/jira/browse/SANTUARIO-334
2
reference_url http://svn.apache.org/viewvc?view=revision&revision=1367492
reference_id
reference_type
scores
url http://svn.apache.org/viewvc?view=revision&revision=1367492
3
reference_url https://bugzilla.redhat.com/CVE-2013-5823
reference_id CVE-2013-5823
reference_type
scores
url https://bugzilla.redhat.com/CVE-2013-5823
fixed_packages
0
url pkg:maven/org.apache.santuario/xmlsec@1.5.3
purl pkg:maven/org.apache.santuario/xmlsec@1.5.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.santuario/xmlsec@1.5.3
aliases CVE-2013-5823
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-a43t-774n-kbb7
1
url VCID-pfcq-4wxh-ckdv
vulnerability_id VCID-pfcq-4wxh-ckdv
summary 
XML signature HMAC truncation authentication bypass
This package uses a parameter that defines an HMAC truncation length (`HMACOutputLength`) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
references
0
reference_url http://svn.apache.org/viewvc?view=revision&revision=794013
reference_id
reference_type
scores
url http://svn.apache.org/viewvc?view=revision&revision=794013
1
reference_url https://bugzilla.redhat.com/CVE-2009-0217
reference_id CVE-2009-0217
reference_type
scores
url https://bugzilla.redhat.com/CVE-2009-0217
fixed_packages
0
url pkg:maven/org.apache.santuario/xmlsec@1.4.3
purl pkg:maven/org.apache.santuario/xmlsec@1.4.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.santuario/xmlsec@1.4.3
aliases CVE-2009-0217
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-pfcq-4wxh-ckdv
2
url VCID-qspg-3tg3-p7ep
vulnerability_id VCID-qspg-3tg3-p7ep
summary 
Cryptographic Issues
Attackers could spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak canonicalization algorithm to apply to the `SignedInfo` part of the Signature.
references
0
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2172
reference_id
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2172
1
reference_url http://santuario.apache.org/secadv.data/CVE-2013-2172.txt.asc
reference_id CVE-2013-2172.TXT.ASC
reference_type
scores
url http://santuario.apache.org/secadv.data/CVE-2013-2172.txt.asc
fixed_packages
0
url pkg:maven/org.apache.santuario/xmlsec@1.4.8
purl pkg:maven/org.apache.santuario/xmlsec@1.4.8
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.santuario/xmlsec@1.4.8
1
url pkg:maven/org.apache.santuario/xmlsec@1.5.5
purl pkg:maven/org.apache.santuario/xmlsec@1.5.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dqwz-byp2-2kcb
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.santuario/xmlsec@1.5.5
aliases CVE-2013-2172
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qspg-3tg3-p7ep
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.santuario/xmlsec@1.4-alpha0