RHSA-2009:1428: Moderate: xmlsec1 security update

First published: Tue Sep 08 2009(Updated: )

The XML Security Library is a C library based on libxml2 and OpenSSL. It<br>implements the XML Signature Syntax and Processing and XML Encryption<br>Syntax and Processing standards. HMAC is used for message authentication<br>using cryptographic hash functions. The HMAC algorithm allows the hash<br>output to be truncated (as documented in RFC 2104).<br>A missing check for the recommended minimum length of the truncated form of<br>HMAC-based XML signatures was found in xmlsec1. An attacker could use this<br>flaw to create a specially-crafted XML file that forges an XML signature,<br>allowing the attacker to bypass authentication that is based on the XML<br>Signature specification. (CVE-2009-0217)<br>Users of xmlsec1 should upgrade to these updated packages, which contain<br>a backported patch to correct this issue. After installing the updated<br>packages, applications that use the XML Security Library must be restarted<br>for the update to take effect.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2009:1428