CVE-2024-34580: SSRF
First published: Wed Jun 26 2024(Updated: )
Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection against an SSRF payload in a KeyInfo element. NOTE: the project disputes this CVE Record on the grounds that any vulnerabilities are the result of a failure to configure XML Security for C++ securely. Even when avoiding this particular issue, any use of this library would need considerable additional code and a deep understanding of the standards and protocols involved to arrive at a secure implementation for any particular use case. We recommend against continued direct use of this library.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache XML Security Library | <=2.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://santuario.apache.org/download.html
- https://cloud.google.com/blog/topics/threat-intelligence/apache-library-allows-server-side-request-forgery
- https://www.sonatype.com/blog/the-exploited-ivanti-connect-ssrf-vulnerability-stems-from-xmltooling-oss-library
- https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2024-21893.md
- https://lists.apache.org/thread/po2gocnw4gtf4boy5mmjb54g62qhbrl9
- https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/3726671873/Santuario
Frequently Asked Questions
What is the severity of CVE-2024-34580?
CVE-2024-34580 is considered to have a moderate severity due to its potential for SSRF exploitation in vulnerable configurations.
How do I fix CVE-2024-34580?
To fix CVE-2024-34580, upgrade to Apache XML Security for C++ version 2.0.5 or later, which addresses this vulnerability.
What is SSRF in the context of CVE-2024-34580?
In the context of CVE-2024-34580, SSRF refers to Server-Side Request Forgery, where an attacker can trick the server into making unauthorized requests.
Which versions of Apache XML Security for C++ are affected by CVE-2024-34580?
CVE-2024-34580 affects all versions of Apache XML Security for C++ up to and including 2.0.4.
Why does Apache dispute the validity of CVE-2024-34580?
Apache disputes CVE-2024-34580 on the grounds that any vulnerabilities are due to improper configuration, rather than flaws in the library itself.
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- agent/weakness
- collector/nvd-api
- source/NVD
- agent/references
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/apache xml security library