Search for packages
Package details: pkg:maven/org.apache.santuario/xmlsec@1.4.2
purl pkg:maven/org.apache.santuario/xmlsec@1.4.2
Tags Ghost
Next non-vulnerable version 2.2.6
Latest non-vulnerable version 3.0.3
Risk 10.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-s9fq-hc6s-aaad
Aliases:
CVE-2009-0217
GHSA-8hfm-837h-hjg5
XML signature HMAC truncation authentication bypass This package uses a parameter that defines an HMAC truncation length (`HMACOutputLength`) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
1.4.3
Affected by 5 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2024-09-17T22:37:40.299451+00:00 GitLab Importer Affected by VCID-s9fq-hc6s-aaad https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.santuario/xmlsec/CVE-2009-0217.yml 34.0.1
2024-01-03T18:00:33.689426+00:00 GitLab Importer Affected by VCID-s9fq-hc6s-aaad https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.santuario/xmlsec/CVE-2009-0217.yml 34.0.0rc1