CVE-2013-2172: jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x be...

Security readout for executives and security teams

This issue affects Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5. In affected uses, an attacker may be able to make a tampered XML signature appear trusted by choosing a weak canonicalization method. Impact depends on whether the application relies on XML signatures for trust decisions. Exposure is most likely in Java applications or vendor products that include vulnerable Apache Santuario XML Security for Java and validate XML Signatures. Downstream advisories from Red Hat, Ubuntu, VMware, and Oracle indicate packaged or bundled exposure existed, but the bundle does not enumerate all affected products. Treat as a targeted trust-bypass risk rather than a broad internet worm risk. Prioritize patching systems that accept signed XML from outside parties or use XML signatures for identity, authorization, or high-value transactions. Mitigation focus: Upgrade Apache Santuario XML Security for Java to 1.4.8, 1.5.5, or later.; Apply relevant vendor updates for affected Red Hat, Ubuntu, VMware, or Oracle products.; Inventory applications and packaged products that include Santuario XML Security for Java..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.