In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a…

Description

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.

Timeline

Scores

EPSS (exploitation in 30 days)

0.78% · top 44% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Weakness

• Process Control
• CWE-20 (opens in a new tab)All about CWE-20 and its CVEs

Affected products

• Apache · Apache Santuario - XML Security for Java

  • affected All 2.0.x releases from 2.0.3
  • affected all 2.1.x releases before 2.1.4.

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.apache.santuario:xmlsecGHSA-4q98-wr72-h35w (opens in a new tab)

References (14)

• [santuario-dev] 20190905 Re: [CVE-2019-12400] Apache Santuario potentially loads XML parsing code from an untrusted source (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [santuario-dev] 20190906 Re: [CVE-2019-12400] Apache Santuario potentially loads XML parsing code from an untrusted source (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2020:0806 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0811 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0804 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0805 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [tomee-commits] 20200324 [jira] [Created] (TOMEE-2791) TomEE plus(7.0.7) is affected by CVE-2019-12400 vulnerability (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomee-commits] 20200720 [jira] [Created] (TOMEE-2885) Update Apache XML Security for Java to mitigate CVE-2019-12400 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomee-commits] 20200720 [jira] [Assigned] (TOMEE-2885) Update Apache XML Security for Java to mitigate CVE-2019-12400 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomee-commits] 20200720 [jira] [Commented] (TOMEE-2885) Update Apache XML Security for Java to mitigate CVE-2019-12400 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [santuario-commits] 20210917 svn commit: r1076843 - in /websites/production/santuario/content: cache/main.pageCache index.html javaindex.html secadv.data/CVE-2021-40690.txt.asc secadv.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuoct2021.html (opens in a new tab)x_refsource_MISCx_transferred
• http://santuario.apache.org/secadv.data/CVE-2019-12400.asc?version=1&modificationDate=1566573083000&api=v2 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://security.netapp.com/advisory/ntap-20190910-0003/ (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-4q98-wr72-h35w (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-12400](https://trackcve.app/badge/CVE-2019-12400.svg)](https://trackcve.app/cve/CVE-2019-12400)

Record last updated 4 Aug 2024, 23:17 UTC.