Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.santuario/xmlsec@1.5.5
Typemaven
Namespaceorg.apache.santuario
Namexmlsec
Version1.5.5
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version1.5.6
Latest_non_vulnerable_version3.0.3
Affected_by_vulnerabilities
0
url VCID-dqwz-byp2-2kcb
vulnerability_id VCID-dqwz-byp2-2kcb
summary 
Java XML Signature DoS Attack
When applying Transforms this package allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.
references
0
reference_url https://bugzilla.redhat.com/CVE-2013-4517
reference_id CVE-2013-4517
reference_type
scores
url https://bugzilla.redhat.com/CVE-2013-4517
1
reference_url https://cwiki.apache.org/confluence/download/attachments/27821224/cve-2013-4517.txt.asc
reference_id CVE-2013-4517.TXT.ASC
reference_type
scores
url https://cwiki.apache.org/confluence/download/attachments/27821224/cve-2013-4517.txt.asc
fixed_packages
0
url pkg:maven/org.apache.santuario/xmlsec@1.5.6
purl pkg:maven/org.apache.santuario/xmlsec@1.5.6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.santuario/xmlsec@1.5.6
aliases CVE-2013-4517
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dqwz-byp2-2kcb
Fixing_vulnerabilities
0
url VCID-qspg-3tg3-p7ep
vulnerability_id VCID-qspg-3tg3-p7ep
summary 
Cryptographic Issues
Attackers could spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak canonicalization algorithm to apply to the `SignedInfo` part of the Signature.
references
0
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2172
reference_id
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2172
1
reference_url http://santuario.apache.org/secadv.data/CVE-2013-2172.txt.asc
reference_id CVE-2013-2172.TXT.ASC
reference_type
scores
url http://santuario.apache.org/secadv.data/CVE-2013-2172.txt.asc
fixed_packages
0
url pkg:maven/org.apache.santuario/xmlsec@1.4.8
purl pkg:maven/org.apache.santuario/xmlsec@1.4.8
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.santuario/xmlsec@1.4.8
1
url pkg:maven/org.apache.santuario/xmlsec@1.5.5
purl pkg:maven/org.apache.santuario/xmlsec@1.5.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dqwz-byp2-2kcb
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.santuario/xmlsec@1.5.5
aliases CVE-2013-2172
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qspg-3tg3-p7ep
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.santuario/xmlsec@1.5.5