In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up
    creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can
    register a malicious implementation with the thread context class loader first, then this implementation
    might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security
    flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for
    Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4. (CVE-2019-12400)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up     creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can     register a malicious implementation with the thread context class loader first, then this implementation     might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security     flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for     Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4. (CVE-2019-12400)

Note that Nessus relies on the presence of the package as reported by the vendor.

The 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence     Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of     Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). (CVE-2021-35617)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services     (slf4j-ext)). The supported version that is affected is 12.1.3.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base     Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). (CVE-2018-8088)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score     7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). (CVE-2021-35620)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0806 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.7 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.2.6, and     includes bug fixes and enhancements. See the Red Hat JBoss Enterprise     Application Platform 7.2.7 Release Notes for information about the most     significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * commons-beanutils: apache-commons-beanutils: does not suppresses the class     property in PropertyUtilsBean by default (CVE-2019-10086)

    * libthrift: thrift: Endless loop when feed with specific input data     (CVE-2019-0205)

    * libthrift: thrift: Out-of-bounds read related to TJSONProtocol or     TSimpleJSONProtocol (CVE-2019-0210)

    * xmlsec: xml-security: Apache Santuario potentially loads XML parsing code from     an untrusted source (CVE-2019-12400)

    * wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider     is in use (CVE-2019-14887)

    * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)

    * netty: HTTP request smuggling (CVE-2019-20444)

    * netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length     header (CVE-2019-20445)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0805 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.7 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.6, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.7 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * commons-beanutils: apache-commons-beanutils: does not suppresses the class     property in PropertyUtilsBean by default (CVE-2019-10086)

    * libthrift: thrift: Endless loop when feed with specific input data     (CVE-2019-0205)

    * libthrift: thrift: Out-of-bounds read related to TJSONProtocol or     TSimpleJSONProtocol (CVE-2019-0210)

    * xmlsec: xml-security: Apache Santuario potentially loads XML parsing code from     an untrusted source (CVE-2019-12400)

    * wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider     is in use (CVE-2019-14887)

    * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)

    * netty: HTTP request smuggling (CVE-2019-20444)

    * netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length     header (CVE-2019-20445)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0804 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.7 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.6, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.7 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * commons-beanutils: apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean     by default (CVE-2019-10086)

    * libthrift: thrift: Endless loop when feed with specific input data (CVE-2019-0205)

    * libthrift: thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210)

    * xmlsec: xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source     (CVE-2019-12400)

    * wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider     is in use (CVE-2019-14887)

    * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)

    * netty: HTTP request smuggling (CVE-2019-20444)

    * netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length     header (CVE-2019-20445)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
422190	SCA: security update for org.apache.santuario:xmlsec (GHSA-4q98-wr72-h35w)	Tenable Cloud Security	SCA Checks	Local	medium
422190	SCA: security update for org.apache.santuario:xmlsec (GHSA-4q98-wr72-h35w)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
222522	Linux Distros Unpatched Vulnerability : CVE-2019-12400	Nessus	Misc.	Local	medium
154771	Oracle WebLogic Server Multiple Vulnerabilities (Oct 2021 CPU)	Nessus	Misc.	Local	critical
134614	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 8 (RHSA-2020:0806)	Nessus	Red Hat Local Security Checks	Local	critical
134613	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 7 (RHSA-2020:0805)	Nessus	Red Hat Local Security Checks	Local	critical
134612	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 6 (RHSA-2020:0804)	Nessus	Red Hat Local Security Checks	Local	critical

Detections

Analytics

CVE-2019-12400

medium

Tenable Plugins

medium

medium

medium

critical

critical

critical

critical