CVE-2013-2153: Medium severity apache xml security for c++ vulnerability
The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypass issue."
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2153?
CVE-2013-2153 is considered a moderate severity vulnerability allowing for signature reuse and content spoofing.
How do I fix CVE-2013-2153?
To fix CVE-2013-2153, upgrade to Apache Santuario XML Security for C++ version 1.7.1 or later.
What types of attacks does CVE-2013-2153 enable?
CVE-2013-2153 enables context-dependent attackers to reuse XML signatures and spoof content.
Which versions of Apache XML Security for C++ are affected by CVE-2013-2153?
Versions up to and including 1.7.0, and specific earlier versions such as 0.1.0 through 1.6.1 are affected by CVE-2013-2153.
Is CVE-2013-2153 specific to a certain platform or environment?
CVE-2013-2153 specifically impacts applications utilizing Apache Santuario XML Security for C++ regardless of platform.