{"id":"CVE-2013-4517","aliases":["DEBIAN-CVE-2013-4517","EUVD-2022-2411","GHSA-4p4w-6h54-g885","MGASA-2014-0558","RHSA-2014:0170","RHSA-2014:0171","RHSA-2014:1726","RHSA-2014:1728","UBUNTU-CVE-2013-4517"],"status":"published","title":"Improper Input Validation in Apache Santuario XML Security","description":"Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.08863,"percentile":0.95246,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-399"],"published":"2014-01-11T01:00:00Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Maven","package":"org.apache.santuario:xmlsec","fixed_in":["1.5.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libxml-security-java","fixed_in":["1.5.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml-security-java","fixed_in":["1.5.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml-security-java","fixed_in":["1.5.6-1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"xml-security","fixed_in":["1.5.7-1.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"xml-security","fixed_in":["0:1.5.6-3.ep5.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"xml-security","fixed_in":["0:1.5.6-3.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"xml-security","fixed_in":["0:1.5.6-3.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"xml-security","fixed_in":["0:1.5.6-3.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"xml-security","fixed_in":["0:1.5.6-3.el6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.santuario:xmlsec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxml-security-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxml-security-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxml-security-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.santuario:xmlsec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6"}]}],"versions":["1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5"]},{"source":"osv","ecosystem":"Mageia:4","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.7-1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossas-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"hornetq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.14-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jacorb-jboss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-13.redhat_6.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-appclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-client-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-clustering","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-cmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-configadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-controller-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-core-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-deployment-repository","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-deployment-scanner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-domain-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-domain-management","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-ee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-ee-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-ejb3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-host-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jacorb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jaxr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jdr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jsr77","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-management-client-content","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-modcluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-naming","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-osgi-configadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-osgi-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-platform-mbean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-pojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-process-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-remoting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-sar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-system-jmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-threads","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-transactions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-version","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-webservices","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-weld","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-xts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-logmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-marshalling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.3-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-xnio-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.9-1.GA_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossas-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-5.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossas-modules-eap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-6.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.0-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.7-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"picketbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.19-2.SP3_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"weld-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.17-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.6-1.redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.4-5.redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossas-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"hornetq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.14-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jacorb-jboss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-13.redhat_6.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-appclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-client-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-clustering","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-cmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-configadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-controller-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-core-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-deployment-repository","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-deployment-scanner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-domain-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-domain-management","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-ee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-ee-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-ejb3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-host-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jacorb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jaxr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jdr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jsr77","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-management-client-content","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-modcluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-naming","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-osgi-configadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-osgi-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-platform-mbean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-pojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-process-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-remoting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-sar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-system-jmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-threads","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-transactions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-version","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-webservices","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-weld","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-xts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-logmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-marshalling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.3-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-xnio-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.9-1.GA_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossas-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-5.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossas-modules-eap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-6.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.0-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.7-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"picketbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.19-2.SP3_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"weld-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.17-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.6-1.redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.4-5.redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.6-3.ep5.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.6-3.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.6-3.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.6-3.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.6-3.el6"}]}]}],"products":[{"vendor":"apache","product":"santuario_xml_security_for_java"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2014-1728.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1726.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0170.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0675.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://osvdb.org/101169","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0850.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0195.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://www.tenable.com/security/tns-2018-15","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89891","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1727.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0851.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2013/Dec/169","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1029524","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0172.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://santuario.apache.org/secadv.data/cve-2013-4517.txt.asc","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0171.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://packetstormsecurity.com/files/124554/Java-XML-Signature-Denial-Of-Service-Attack.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/64437","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1725.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/55639","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4517","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3@%3Ccommits.santuario.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd@%3Ccommits.santuario.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/santuario-java/commit/a09b9042f7759d094f2d49f40fc7bcf145164b25","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4p4w-6h54-g885"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4517","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0558.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14485","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-November/142709.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0170","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/JBoss_Enterprise_Application_Platform/6.2/html/6.2.1_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1038643","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1043332","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1045257","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052783","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053216","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053231","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053779","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0170.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4517","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4517","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6440","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6440","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6440","tags":["advisory"]},{"url":"http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0018","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0018","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0171","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1038647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052717","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052988","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053778","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0171.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1726","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1726.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1728","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1728.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-4517","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-4517","description":"Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.","status":"published","published":"2014-01-11T01:00:00Z","modified":"2024-08-06T16:45:14.816Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2022-2411","description":"Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.","status":"published","published":"2014-01-11T01:00:00Z","modified":"2024-08-06T16:45:14Z","updated_at":"2026-11-03T01:56:31.067159Z"}],"ghsa":[{"id":"GHSA-4p4w-6h54-g885","title":"Improper Input Validation in Apache Santuario XML Security","description":"Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.","status":"published","published":"2022-05-13T01:05:55Z","modified":"2024-03-05T00:55:47Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:39.730152Z"}],"nvd":[{"id":"CVE-2013-4517","description":"Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.","status":"published","published":"2014-01-11T01:55:03.05Z","modified":"2026-06-16T23:57:22.41Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"CVE-2013-4517","description":"Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.","status":"published","published":"2014-01-11T01:55:03Z","modified":"2026-04-16T06:25:41.631554024Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4517","description":"Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.","status":"published","published":"2014-01-11T01:55:03.05Z","modified":"2026-09-01T20:03:18.326658503Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"GHSA-4p4w-6h54-g885","title":"Improper Input Validation in Apache Santuario XML Security","description":"Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.","status":"published","published":"2022-05-13T01:05:55Z","modified":"2024-11-30T05:51:56.260419Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"MGASA-2014-0558","title":"Updated xml-security packages fix CVE-2013-4517","description":"Updated xml-security packages fixes security vulnerability:\n\nApache Santuario XML Security for Java before 1.5.6, when applying\nTransforms, allows remote attackers to cause a denial of service (memory\nconsumption) via crafted Document Type Definitions (DTDs), related to\nsignatures (CVE-2013-4517).\n","status":"published","published":"2014-12-31T12:28:04Z","modified":"2026-04-16T06:24:48.454261353Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"RHSA-2014:0170","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 update","status":"published","published":"2024-09-29T16:45:50Z","modified":"2026-08-05T10:02:24Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:0171","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 update","status":"published","published":"2024-09-29T16:45:56Z","modified":"2026-08-05T10:02:24Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:1726","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update","status":"published","published":"2024-09-29T16:46:26Z","modified":"2026-08-05T10:02:57Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1728","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update","status":"published","published":"2024-09-29T16:46:52Z","modified":"2026-08-05T10:02:58Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"UBUNTU-CVE-2013-4517","description":"Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.","status":"withdrawn","published":"2014-01-11T01:55:00Z","modified":"2025-07-16T07:31:23.021437Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}