{"id":"CVE-2009-0217","aliases":["DEBIAN-CVE-2009-0217","DSA-1849-1","DSA-1995-1","DTSA-205-1","EUVD-2022-3187","GHSA-8hfm-837h-hjg5","RHSA-2009:1200","RHSA-2009:1201","RHSA-2009:1428","RHSA-2009:1636","RHSA-2009:1637","RHSA-2009:1649","RHSA-2009:1650","RHSA-2009:1694","RHSA-2010:0043"],"status":"published","title":"Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation","description":"The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.06363,"percentile":0.93738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2009-07-14T23:00:00Z","modified":"2026-10-23T17:47:47Z","fixes":[{"ecosystem":"Maven","package":"org.apache.santuario:xmlsec","fixed_in":["1.4.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"mono","fixed_in":["2.4.2.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mono","fixed_in":["2.4.2.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mono","fixed_in":["2.4.2.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xml-security-c","fixed_in":["1.4.0-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xml-security-c","fixed_in":["1.4.0-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xml-security-c","fixed_in":["1.4.0-4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xmlsec1","fixed_in":["1.2.12-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xmlsec1","fixed_in":["1.2.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xmlsec1","fixed_in":["1.2.12-1"],"sources":["osv"]},{"ecosystem":"Debian:4.0","package":"xml-security-c","fixed_in":["1.2.1-3+etch1"],"sources":["osv"]},{"ecosystem":"Debian:5.0","package":"xml-security-c","fixed_in":["1.4.0-3+lenny2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"xmlsec1","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"xmlsec1-debuginfo","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"xmlsec1-devel","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"xmlsec1-openssl","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"xmlsec1-openssl-devel","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"xmlsec1","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"xmlsec1-debuginfo","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"xmlsec1-devel","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"xmlsec1-openssl","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"xmlsec1-openssl-devel","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"xmlsec1","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"xmlsec1-debuginfo","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"xmlsec1-devel","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"xmlsec1-openssl","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"xmlsec1-openssl-devel","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"xmlsec1","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"xmlsec1-debuginfo","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"xmlsec1-devel","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"xmlsec1-openssl","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"xmlsec1-openssl-devel","fixed_in":["0:1.2.6-3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xmlsec1","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xmlsec1-debuginfo","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xmlsec1-devel","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xmlsec1-gnutls-devel","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xmlsec1-nss-devel","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xmlsec1-openssl-devel","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xmlsec1","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xmlsec1-debuginfo","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xmlsec1-gnutls","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xmlsec1-nss","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xmlsec1-openssl","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-debuginfo","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-devel","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-gnutls","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-gnutls-devel","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-nss","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-nss-devel","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-openssl","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-openssl-devel","fixed_in":["0:1.2.9-8.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.santuario:xmlsec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-1"}]}]},{"source":"osv","ecosystem":"Debian:4.0","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-3+etch1"}]}],"versions":["1.2.1-3"]},{"source":"osv","ecosystem":"Debian:5.0","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3+lenny2"}]}],"versions":["1.4.0-3"]},{"source":"osv","ecosystem":"Debian:4.0","package":"openoffice.org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4.dfsg.2-7etch9"}]}],"versions":["2.0.4.dfsg.2-5etch1","2.0.4.dfsg.2-5etch2","2.0.4.dfsg.2-6","2.0.4.dfsg.2-7","2.0.4.dfsg.2-7etch1","2.0.4.dfsg.2-7etch2","2.0.4.dfsg.2-7etch4","2.0.4.dfsg.2-7etch5","2.0.4.dfsg.2-7etch6","2.0.4.dfsg.2-7etch7","2.0.4.dfsg.2-7etch8"],"bundled":6},{"source":"osv","ecosystem":"Debian:5.0","package":"openoffice.org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.1+dfsg-1+lenny6"}]}],"versions":["1:2.4.1+dfsg-1","1:2.4.1+dfsg-1+lenny1","1:2.4.1+dfsg-1+lenny3","1:2.4.1+dfsg-1+lenny4","1:2.4.1+dfsg-1+lenny5","1:2.4.1-17"],"bundled":6},{"source":"osv","ecosystem":"Debian:6.0","package":"openoffice.org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.1-15+squeeze1"}]}],"bundled":5},{"source":"osv","ecosystem":"Maven","package":"org.apache.santuario:xmlsec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.3"}]}],"versions":["1.4.0","1.4.1","1.4.2"]},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.6.0-sun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.6.0-sun-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.6.0-sun-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.6.0-sun-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.6.0-sun-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.6.0-sun-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-sun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el5"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-sun-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el5"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-sun-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el5"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-sun-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el5"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-sun-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el5"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-sun-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el5"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-sun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el5"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-sun-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el5"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-sun-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el5"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-sun-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el5"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-sun-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el5"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-sun-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.15-1jpp.1.el5"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"java-1.6.0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.0-1.2.b09.el5"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"java-1.6.0-openjdk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.0-1.2.b09.el5"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"java-1.6.0-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.0-1.2.b09.el5"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"java-1.6.0-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.0-1.2.b09.el5"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"java-1.6.0-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.0-1.2.b09.el5"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"java-1.6.0-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.0-1.2.b09.el5"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"java-1.6.0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.0-1.2.b09.el5"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"java-1.6.0-openjdk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.0-1.2.b09.el5"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"java-1.6.0-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.0-1.2.b09.el5"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"java-1.6.0-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.0-1.2.b09.el5"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"java-1.6.0-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.0-1.2.b09.el5"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"java-1.6.0-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.0-1.2.b09.el5"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"xmlsec1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"xmlsec1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"xmlsec1-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"xmlsec1-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"xmlsec1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"xmlsec1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"xmlsec1-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"xmlsec1-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"xmlsec1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"xmlsec1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"xmlsec1-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"xmlsec1-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"xmlsec1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"xmlsec1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"xmlsec1-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"xmlsec1-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xmlsec1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xmlsec1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xmlsec1-gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xmlsec1-nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xmlsec1-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xmlsec1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xmlsec1-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xmlsec1-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xmlsec1-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xmlsec1-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-8.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"glassfish-javamail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-0jpp.ep1.5.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"glassfish-jaxb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.12.patch03.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"glassfish-jaxb-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.12.patch03.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"glassfish-jsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2_13-2.1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"hibernate3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"hibernate3-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.11.GA_CP02.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"hibernate3-annotations-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.11.GA_CP02.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"hibernate3-entitymanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-2.5.GA_CP01.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"hibernate3-entitymanager-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-2.5.GA_CP01.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"hibernate3-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jacorb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1jpp.ep1.9.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jakarta-commons-logging-jboss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1-9.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-aop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5-3.CP04.2.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-0jpp.ep1.3.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0-3.SP3_CP09.4.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-remoting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-3.SP1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-seam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.18.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-seam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.18.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-seam2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2.FP-1.ep1.21.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-seam2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2.FP-1.ep1.21.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-6.GA_CP07.4.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossas-4.3.0.GA_CP07-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-6.GA_CP07.4.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossas-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-6.GA_CP07.4.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-6.CP12.0jpp.ep1.2.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-4.SP2_CP07.2.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossws-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-2.GA_CP05.1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossws-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.GA_CP05.1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossws-native42","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-4.SP2_CP07.2.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jcommon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.16-1.1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jfreechart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.13-2.3.1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jgroups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.7-1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"quartz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-1jpp.patch01.ep1.4.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"rh-eap-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-6.GA_CP07.ep1.3.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"rh-eap-docs-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-6.GA_CP07.ep1.3.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-9jpp.4.patch_02.1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-1.3.patch01.ep1.2.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"glassfish-javamail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-0jpp.ep1.5.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"glassfish-jsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2_13-2.1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"hibernate3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"hibernate3-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.11.GA_CP02.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"hibernate3-annotations-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.11.GA_CP02.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"hibernate3-entitymanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-2.5.GA_CP01.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"hibernate3-entitymanager-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-2.5.GA_CP01.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"hibernate3-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jacorb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1jpp.ep1.9.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jakarta-commons-logging-jboss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1-9.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jboss-aop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5-3.CP04.2.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jboss-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-0jpp.ep1.3.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jboss-remoting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-3.SP1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jboss-seam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.ep1.22.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jboss-seam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.ep1.22.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-5.GA_CP08.5.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossas-4.2.0.GA_CP08-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-5.GA_CP08.5.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossas-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-5.GA_CP08.5.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-6.CP12.0jpp.ep1.2.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jcommon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.16-1.1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jfreechart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.13-2.3.1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jgroups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.7-1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"quartz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-1jpp.patch01.ep1.4.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"rh-eap-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP08.ep1.3.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"rh-eap-docs-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP08.ep1.3.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-9jpp.4.patch_02.1.ep1.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-1.3.patch01.ep1.2.el4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"glassfish-jaxb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.12.patch03.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"glassfish-jaxb-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-1.12.patch03.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"glassfish-jsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2_13-2.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"hibernate3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP09.0jpp.ep1.2.4.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"hibernate3-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.11GA_CP02.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"hibernate3-annotations-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.11GA_CP02.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"hibernate3-entitymanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-2.5.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"hibernate3-entitymanager-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-2.5.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"hibernate3-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP09.0jpp.ep1.2.4.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jacorb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1jpp.ep1.9.1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-aop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5-3.CP04.2.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-0jpp.ep1.3.el5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0-3.SP3_CP09.4.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-remoting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-3.SP1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-seam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.12.el5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-seam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.12.el5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-seam2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2.FP-1.ep1.18.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-seam2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2.FP-1.ep1.18.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-6.GA_CP07.4.2.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossas-4.3.0.GA_CP07-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-6.GA_CP07.4.2.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossas-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-6.GA_CP07.4.2.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-6.CP12.0jpp.ep1.2.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-4.SP2_CP07.2.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossws-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-2.GA_CP05.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossws-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.GA_CP05.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossws-native42","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-4.SP2_CP07.2.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jcommon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.16-1.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jfreechart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.13-2.3.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jgroups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.7-1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"quartz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-1jpp.patch01.ep1.4.1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"rh-eap-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-6.GA_CP07.ep1.3.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"rh-eap-docs-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-6.GA_CP07.ep1.3.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-1.3.patch01.ep1.2.1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"glassfish-jsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2_13-2.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"hibernate3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP09.0jpp.ep1.2.4.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"hibernate3-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.11GA_CP02.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"hibernate3-annotations-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.11GA_CP02.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"hibernate3-entitymanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-2.5.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"hibernate3-entitymanager-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-2.5.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"hibernate3-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP09.0jpp.ep1.2.4.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jacorb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1jpp.ep1.9.1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jboss-aop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5-3.CP04.2.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jboss-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-0jpp.ep1.3.el5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jboss-remoting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-3.SP1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jboss-seam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.ep1.14.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jboss-seam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.ep1.14.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-5.GA_CP08.5.2.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossas-4.2.0.GA_CP08-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-5.GA_CP08.5.2.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossas-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-5.GA_CP08.5.2.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-6.CP12.0jpp.ep1.2.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jcommon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.16-1.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jfreechart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.13-2.3.1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jgroups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.7-1.ep1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"quartz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-1jpp.patch01.ep1.4.1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"rh-eap-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP08.ep1.3.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"rh-eap-docs-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP08.ep1.3.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-1.3.patch01.ep1.2.1.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.6.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.3.el4"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.6.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.3.el4"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.6.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.3.el4"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.6.0-ibm-javacomm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.3.el4"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.6.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.3.el4"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.6.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.3.el4"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"java-1.6.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.3.el4"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-ibm-accessibility","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-ibm-javacomm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"java-1.6.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-ibm-accessibility","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-ibm-javacomm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"java-1.6.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.3::el4","package":"java-1.6.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.3.el4"}]}],"bundled":35},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.3::el4","package":"java-1.6.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.3.el4"}]}],"bundled":35},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.3::el5","package":"java-1.6.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":35},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.3::el5","package":"java-1.6.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.0.7-1jpp.2.el5"}]}],"bundled":35}],"products":[{"vendor":"ibm","product":"websphere_application_server"},{"vendor":"mono_project","product":"mono"},{"vendor":"oracle","product":"application_server"},{"vendor":"oracle","product":"bea_product_suite"},{"vendor":"oracle","product":"weblogic_server_component"}],"references":[{"url":"https://rhn.redhat.com/errata/RHSA-2009-1428.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.vupen.com/english/advisories/2009/3122","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://www.openoffice.org/security/cves/CVE-2009-0217.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=47526","tags":["x_refsource_CONFIRM","x_transferred","report","web"]},{"url":"http://secunia.com/advisories/60799","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023545\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://rhn.redhat.com/errata/RHSA-2009-1200.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/35776","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/36162","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/36494","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/2543","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/35858","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/38695","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred","web"]},{"url":"http://www.debian.org/security/2010/dsa-1995","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://secunia.com/advisories/35853","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://rhn.redhat.com/errata/RHSA-2009-1637.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2009-1694.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://secunia.com/advisories/35852","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/35854","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/34461","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.kb.cert.org/vuls/id/WDON-7TY529","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mono-project.com/Vulnerabilities","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-903-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/35671","tags":["vdb-entry","x_refsource_BID","x_transferred","Patch","fix"]},{"url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=47527","tags":["x_refsource_CONFIRM","x_transferred","report","web"]},{"url":"http://www.vupen.com/english/advisories/2010/0366","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://osvdb.org/55907","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2009:209","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/38567","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred","web"]},{"url":"http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://www.vupen.com/english/advisories/2009/1900","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.securitytracker.com/id?1022561","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/37671","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.kb.cert.org/vuls/id/466161","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource","web"]},{"url":"http://www.securitytracker.com/id?1022567","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2009-1636.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023723\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://rhn.redhat.com/errata/RHSA-2009-1649.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-294A.html","tags":["third-party-advisory","x_refsource_CERT","x_transferred","US Government Resource","web"]},{"url":"http://www.vupen.com/english/advisories/2009/1909","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.vupen.com/english/advisories/2010/0635","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://svn.apache.org/viewvc?revision=794013\u0026view=revision","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/38568","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/36180","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.w3.org/2008/06/xmldsigcore-errata.html#e03","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://usn.ubuntu.com/826-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://secunia.com/advisories/37841","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/35855","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://secunia.com/advisories/36176","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/1908","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://secunia.com/advisories/41818","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id?1022661","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://secunia.com/advisories/37300","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/1911","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2009-1201.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-159B.html","tags":["third-party-advisory","x_refsource_CERT","x_transferred","US Government Resource","web"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://osvdb.org/55895","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://www.aleksey.com/xmlsec/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041","tags":["vendor-advisory","x_refsource_MS","x_transferred","web"]},{"url":"http://secunia.com/advisories/38921","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://rhn.redhat.com/errata/RHSA-2009-1650.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=511915","tags":["x_refsource_CONFIRM","x_transferred","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0217","tags":["advisory"]},{"url":"https://gitlab.gnome.org/Archive/xmlsec/-/commit/34b349675af9f72eb822837a8772cc1ead7115c7","tags":["web"]},{"url":"https://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html","tags":["web"]},{"url":"https://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2","tags":["web"]},{"url":"https://svn.apache.org/viewvc?revision=794013\u0026view=revision","tags":["web"]},{"url":"https://www.debian.org/security/2010/dsa-1995","tags":["web"]},{"url":"https://www.gentoo.org/security/en/glsa/glsa-201408-19.xml","tags":["web"]},{"url":"https://www.kb.cert.org/vuls/id/466161","tags":["web"]},{"url":"https://www.kb.cert.org/vuls/id/MAPG-7TSKXQ","tags":["web"]},{"url":"https://www.kb.cert.org/vuls/id/WDON-7TY529","tags":["web"]},{"url":"https://www.mandriva.com/security/advisories?name=MDVSA-2009:209","tags":["web"]},{"url":"https://www.redhat.com/support/errata/RHSA-2009-1694.html","tags":["web"]},{"url":"https://www.ubuntu.com/usn/USN-903-1","tags":["web"]},{"url":"https://www.us-cert.gov/cas/techalerts/TA09-294A.html","tags":["web"]},{"url":"https://www.w3.org/2008/06/xmldsigcore-errata.html#e03","tags":["web"]},{"url":"https://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8hfm-837h-hjg5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2009-0217","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:1200","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"http://blogs.sun.com/security/entry/advance_notification_of_security_updates5","tags":["article"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-16-1","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=512896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=512907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=512914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=512915","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=512920","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=512921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=513215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=513220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=513223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=515890","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1200.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-0217","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-0217","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2475","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2475","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2475","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2476","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2476","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2476","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2625","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2625","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2670","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2670","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2670","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2671","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2671","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2671","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2672","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2673","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2673","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2674","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2674","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2674","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2675","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2675","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2676","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2690","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2690","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2716","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=516812","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2716","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=516815","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2718","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2718","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=516820","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2719","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2719","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2720","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=516823","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2720","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2720","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:1201","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=499079","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=513222","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1201.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2689","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2689","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:1428","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"http://www.w3.org/TR/xmldsig-core/","tags":["article"]},{"url":"http://tools.ietf.org/html/rfc2104","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1428.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:1636","tags":["advisory"]},{"url":"http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=510023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=511224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=532117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=539495","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1636.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1380","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1380","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2405","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2405","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3554","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3554","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3554","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:1637","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=532116","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1637.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:1649","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=532113","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1649.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:1650","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=532111","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1650.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:1694","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=533215","tags":["report"]},{"url":"http://www.ibm.com/developerworks/java/jdk/alerts/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=530053","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=530057","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=530061","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=530062","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=530063","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=530067","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=532906","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=533211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=533212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=533214","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1694.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=533125","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3555","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3555","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3865","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3865","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3866","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3867","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3867","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3867","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3868","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3868","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3868","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3869","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3871","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3871","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3871","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3872","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3872","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3872","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3873","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3873","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3874","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3875","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3875","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3875","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3876","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3877","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0043","tags":["advisory"]},{"url":"http://www.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=490166","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=490167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=490168","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=490169","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=490174","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=490178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=492302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=492305","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=492306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=492308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=492309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=492310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=492312","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0043.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1093","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1093","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1093","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1094","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1094","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1094","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1095","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1095","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1096","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1096","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1097","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1098","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1099","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1100","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1100","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1101","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1101","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1101","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1103","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1103","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1103","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1104","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1104","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1104","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1105","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1105","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1105","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1106","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1106","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1106","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1107","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1107","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1107","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2009-0217","description":"The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.","status":"published","published":"2009-07-14T23:00:00Z","modified":"2024-08-07T04:24:18.4Z","updated_at":"2026-11-02T14:33:26.302774Z"}],"euvd":[{"id":"EUVD-2022-3187","description":"The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.","status":"published","published":"2009-07-14T23:00:00Z","modified":"2024-08-07T04:24:18Z","updated_at":"2026-11-03T01:39:26.585153Z"}],"ghsa":[{"id":"GHSA-8hfm-837h-hjg5","title":"Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation","description":"The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in multiple products.\n\nThe Apache XML Security (Java) is affected by the vulnerability published in US-Cert VU #466161. See: http://www.kb.cert.org/vuls/id/466161 for more information. This bug can allow an attacker to bypass authentication by inserting/modifying a small HMAC truncation length parameter in the XML Signature HMAC based SignatureMethod algorithms.\n\nAn inexhaustive list of additional affected products includes:  \n1. the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; \n2. the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; \n3. Mono before 2.4.2.2; \n4. XML Security Library before 1.2.12; \n5. IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; \n6. Sun JDK and JRE Update 14 and earlier; \n7. Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.","status":"published","published":"2022-05-02T03:13:38Z","modified":"2023-01-29T05:03:43Z","updated_at":"2026-11-02T14:36:25.835323Z"}],"nvd":[{"id":"CVE-2009-0217","description":"The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.","status":"published","published":"2009-07-14T23:30:00.187Z","modified":"2026-06-16T23:04:31.033Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:36.200173Z"}],"osv":[{"id":"CVE-2009-0217","description":"The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.","status":"published","published":"2009-07-14T23:30:00Z","modified":"2026-04-10T03:40:35.370216Z","updated_at":"2026-11-02T15:43:57.452479Z"},{"id":"DEBIAN-CVE-2009-0217","description":"The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.","status":"published","published":"2009-07-14T23:30:00.187Z","modified":"2026-10-23T17:47:47.161555896Z","updated_at":"2026-11-02T15:45:23.742363Z"},{"id":"DSA-1849-1","title":"xml-security-c - signature forgery","status":"published","published":"2009-08-02T00:00:00Z","modified":"2026-03-09T01:21:25.937558Z","updated_at":"2026-11-02T15:46:14.734124Z"},{"id":"DSA-1995-1","title":"openoffice.org - several","status":"published","published":"2010-02-12T00:00:00Z","modified":"2026-03-09T01:18:21.646499Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"DTSA-205-1","title":"openoffice.org - several vulnerabilities","status":"published","published":"2010-02-15T00:00:00Z","modified":"2026-03-09T01:01:17.52917Z","updated_at":"2026-11-02T15:46:18.716547Z"},{"id":"GHSA-8hfm-837h-hjg5","title":"Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation","description":"The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in multiple products.\n\nThe Apache XML Security (Java) is affected by the vulnerability published in US-Cert VU #466161. See: http://www.kb.cert.org/vuls/id/466161 for more information. This bug can allow an attacker to bypass authentication by inserting/modifying a small HMAC truncation length parameter in the XML Signature HMAC based SignatureMethod algorithms.\n\nAn inexhaustive list of additional affected products includes:  \n1. the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; \n2. the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; \n3. Mono before 2.4.2.2; \n4. XML Security Library before 1.2.12; \n5. IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; \n6. Sun JDK and JRE Update 14 and earlier; \n7. Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.","status":"published","published":"2022-05-02T03:13:38Z","modified":"2024-12-07T05:40:57.163585Z","updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"RHSA-2009:1200","title":"Red Hat Security Advisory: java-1.6.0-sun security update","status":"published","published":"2024-09-29T16:25:27Z","modified":"2026-06-29T10:02:27Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2009:1201","title":"Red Hat Security Advisory: java-1.6.0-openjdk security and bug fix update","status":"published","published":"2024-09-29T16:25:32Z","modified":"2026-06-29T10:02:28Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2009:1428","title":"Red Hat Security Advisory: xmlsec1 security update","status":"published","published":"2024-09-13T06:45:28Z","modified":"2026-06-29T10:02:31Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2009:1636","title":"Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP07 update","status":"published","published":"2024-09-29T16:26:07Z","modified":"2026-06-29T10:02:42Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2009:1637","title":"Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP08 update","status":"published","published":"2024-09-29T16:26:12Z","modified":"2026-06-29T10:02:43Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2009:1649","title":"Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP07 update","status":"published","published":"2024-09-29T16:26:29Z","modified":"2026-06-29T10:02:45Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2009:1650","title":"Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP08 update","status":"published","published":"2024-09-29T16:26:34Z","modified":"2026-06-29T10:02:46Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2009:1694","title":"Red Hat Security Advisory: java-1.6.0-ibm security update","status":"published","published":"2024-09-13T06:46:25Z","modified":"2026-06-29T10:02:50Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2010:0043","title":"Red Hat Security Advisory: Red Hat Network Satellite Server IBM Java Runtime security update","status":"published","published":"2024-09-29T16:26:44Z","modified":"2026-06-29T10:02:55Z","updated_at":"2026-11-02T15:53:00.468834Z"}]}}