{"id":"GHSA-8hfm-837h-hjg5","summary":"Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation","details":"The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in multiple products.\n\nThe Apache XML Security (Java) is affected by the vulnerability published in US-Cert VU #466161. See: http://www.kb.cert.org/vuls/id/466161 for more information. This bug can allow an attacker to bypass authentication by inserting/modifying a small HMAC truncation length parameter in the XML Signature HMAC based SignatureMethod algorithms.\n\nAn inexhaustive list of additional affected products includes:  \n1. the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; \n2. the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; \n3. Mono before 2.4.2.2; \n4. XML Security Library before 1.2.12; \n5. IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; \n6. Sun JDK and JRE Update 14 and earlier; \n7. Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.","aliases":["CVE-2009-0217"],"modified":"2024-12-07T05:40:30.336431Z","published":"2022-05-02T03:13:38Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2022-11-08T14:55:27Z","nvd_published_at":"2009-07-14T23:30:00Z","cwe_ids":[]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0217"},{"type":"WEB","url":"https://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html"},{"type":"WEB","url":"https://www.w3.org/2008/06/xmldsigcore-errata.html#e03"},{"type":"WEB","url":"https://www.us-cert.gov/cas/techalerts/TA09-294A.html"},{"type":"WEB","url":"https://www.ubuntu.com/usn/USN-903-1"},{"type":"WEB","url":"https://www.redhat.com/support/errata/RHSA-2009-1694.html"},{"type":"WEB","url":"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html"},{"type":"WEB","url":"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html"},{"type":"WEB","url":"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"},{"type":"WEB","url":"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"},{"type":"WEB","url":"https://www.mandriva.com/security/advisories?name=MDVSA-2009:209"},{"type":"WEB","url":"https://www.kb.cert.org/vuls/id/WDON-7TY529"},{"type":"WEB","url":"https://www.kb.cert.org/vuls/id/MAPG-7TSKXQ"},{"type":"WEB","url":"https://www.kb.cert.org/vuls/id/466161"},{"type":"WEB","url":"https://www.gentoo.org/security/en/glsa/glsa-201408-19.xml"},{"type":"WEB","url":"https://www.debian.org/security/2010/dsa-1995"},{"type":"WEB","url":"https://svn.apache.org/viewvc?revision=794013&view=revision"},{"type":"WEB","url":"https://rhn.redhat.com/errata/RHSA-2009-1428.html"},{"type":"WEB","url":"https://marc.info/?l=bugtraq&m=125787273209737&w=2"},{"type":"WEB","url":"https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html"},{"type":"WEB","url":"https://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"},{"type":"WEB","url":"https://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"},{"type":"WEB","url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=47527"},{"type":"WEB","url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=47526"},{"type":"WEB","url":"https://gitlab.gnome.org/Archive/xmlsec/-/commit/34b349675af9f72eb822837a8772cc1ead7115c7"},{"type":"WEB","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=511915"},{"type":"WEB","url":"http://www.us-cert.gov/cas/techalerts/TA10-159B.html"}],"affected":[{"package":{"name":"org.apache.santuario:xmlsec","ecosystem":"Maven","purl":"pkg:maven/org.apache.santuario/xmlsec"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.3"}]}],"versions":["1.4.0","1.4.1","1.4.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-8hfm-837h-hjg5/GHSA-8hfm-837h-hjg5.json"}}],"schema_version":"1.9.0"}