CVE-2013-4517

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-4517
Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://osvdb.org/101169
http://packetstormsecurity.com/files/124554/Java-XML-Signature-Denial-Of-Service-Attack.html
http://rhn.redhat.com/errata/RHSA-2014-0170.html
http://rhn.redhat.com/errata/RHSA-2014-0171.html
http://rhn.redhat.com/errata/RHSA-2014-0172.html
http://rhn.redhat.com/errata/RHSA-2014-0195.html
http://rhn.redhat.com/errata/RHSA-2014-1725.html
http://rhn.redhat.com/errata/RHSA-2014-1726.html
http://rhn.redhat.com/errata/RHSA-2014-1727.html
http://rhn.redhat.com/errata/RHSA-2014-1728.html
http://rhn.redhat.com/errata/RHSA-2015-0675.html
http://rhn.redhat.com/errata/RHSA-2015-0850.html
http://rhn.redhat.com/errata/RHSA-2015-0851.html
http://santuario.apache.org/secadv.data/cve-2013-4517.txt.asc Vendor Advisory
http://seclists.org/fulldisclosure/2013/Dec/169
http://secunia.com/advisories/55639 Vendor Advisory
http://www.securityfocus.com/bid/64437
http://www.securitytracker.com/id/1029524
https://exchange.xforce.ibmcloud.com/vulnerabilities/89891
https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E
https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E
https://www.tenable.com/security/tns-2018-15
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:santuario_xml_security_for_java:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.7:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.4:*:*:*:*:*:*:*
History

18 Apr 2023, 19:07

Type Values Removed Values Added
CPE cpe:2.3:a:apache:xml_security_for_java:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.4.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.4.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.4.7:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.4.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.4.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.4.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.5.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.5.2:*:*:*:*:*:*:*		 cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.7:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.3:*:*:*:*:*:*:*

17 Sep 2021, 11:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd@%3Ccommits.santuario.apache.org%3E -
Information

Published : 2014-01-11 01:55

Updated : 2024-02-04 18:16

NVD link : CVE-2013-4517

Mitre link : CVE-2013-4517

CVE.ORG link : CVE-2013-4517

JSON object : View

Products Affected

apache

  • santuario_xml_security_for_java
CWE
CWE-399

Resource Management Errors