CVE-2009-0217 json
Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation
published 2009-07-14 17 y ago modified 2026-06-16 4 mo ago also GHSA-8hfm-837h-hjg5 , EUVD-2022-3187
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 6.4%
- EPSS 6.4% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
Patch / fix
- maven org.apache.santuario:xmlsec 1.4.3
- mono Debian 14, Debian 13, Debian 12 2.4.2.3+dfsg-1
- xmlsec1 Debian 14, Debian 13, Debian 12 1.2.12-1
- xml-security-c Debian 14, Debian 13, Debian 12 1.4.0-4
debian advisories DEBIAN-CVE-2009-0217
- java-1.6.0-ibm RHEL 4 EXTRAS, network satellite 5.3 1:1.6.0.7-1jpp.3.el4
- java-1.6.0-ibm RHEL 5 EXTRAS, network satellite 5.3 1:1.6.0.7-1jpp.2.el5
- jacorb jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 2.3.0-1jpp.ep1.9.1.el5
- quartz jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1.5.2-1jpp.patch01.ep1.4.1.el5
- jbossas jboss enterprise application platform 4.2.0 4.2.0-5.GA_CP08.5.2.ep1.el5
- jbossts jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el5
- jcommon jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1.0.16-1.1.ep1.el5
- jgroups jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1:2.4.7-1.ep1.el5
red hat advisories RHSA-2010:0043RHSA-2009:1650RHSA-2009:1649RHSA-2009:1637RHSA-2009:1636RHSA-2009:1201
- git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7… commit
- gitlab.gnome.org/Archive/xmlsec@34b3496 commit
- securityfocus.com/bid/35671 patch
- www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg2… advisory
- www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg2… advisory
- www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925 advisory
- vupen.com/english/advisories/2009/1900 advisory
- vupen.com/english/advisories/2009/1908 advisory
- vupen.com/english/advisories/2009/1909 advisory
- vupen.com/english/advisories/2009/1911 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2009-0217 updated cvss 5.0
xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass
-
Red Hat Desktop version 4 Extras java-1.6.0-ibm 1.6.0.7-1jpp.3.el4, java-1.6.0-sun 1.6.0.15-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-demo 1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-jdbc 1.6.0.7-1jpp.3.el4, java-1.6.0-sun-src 1.6.0.15-1jpp.1.el4, +5 morefixed: vendor fix RHSA-2009:1694
-
Red Hat Enterprise Linux (v. 5 server) xmlsec1 1.2.9-8.1.1, xmlsec1-nss 1.2.9-8.1.1, xmlsec1-gnutls 1.2.9-8.1.1, xmlsec1-openssl 1.2.9-8.1.1, java-1.6.0-openjdk 1.6.0.0-1.2.b09.el5, java-1.6.0-openjdk-src 1.6.0.0-1.2.b09.el5, +2 more Red Hat Enterprise Linux AS version 4 xmlsec1 1.2.6-3.1, xmlsec1-openssl 1.2.6-3.1fixed: vendor fix RHSA-2009:1428
-
Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-ibm 1.6.0.7-1jpp.3.el4, java-1.6.0-sun 1.6.0.15-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-demo 1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-jdbc 1.6.0.7-1jpp.3.el4, java-1.6.0-sun-src 1.6.0.15-1jpp.1.el4, +5 morefixed: vendor fix RHSA-2009:1694
-
Red Hat Enterprise Linux Desktop (v. 5 client) xmlsec1 1.2.9-8.1.1, xmlsec1-nss 1.2.9-8.1.1, xmlsec1-gnutls 1.2.9-8.1.1, xmlsec1-openssl 1.2.9-8.1.1, java-1.6.0-openjdk 1.6.0.0-1.2.b09.el5, java-1.6.0-openjdk-src 1.6.0.0-1.2.b09.el5, +2 morefixed: vendor fix RHSA-2009:1428
-
Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-ibm 1.6.0.7-1jpp.2.el5, java-1.6.0-sun 1.6.0.15-1jpp.1.el5, java-1.6.0-ibm-src 1.6.0.7-1jpp.2.el5, java-1.6.0-ibm-demo 1.6.0.7-1jpp.2.el5, java-1.6.0-ibm-jdbc 1.6.0.7-1jpp.2.el5, java-1.6.0-sun-src 1.6.0.15-1jpp.1.el5, +6 morefixed: vendor fix RHSA-2009:1694
-
Red Hat Enterprise Linux Desktop version 4 xmlsec1 1.2.6-3.1, xmlsec1-openssl 1.2.6-3.1 Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xmlsec1 1.2.9-8.1.1 Red Hat Enterprise Linux ES version 4 xmlsec1 1.2.6-3.1, xmlsec1-openssl 1.2.6-3.1fixed: vendor fix RHSA-2009:1428
-
Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-ibm 1.6.0.7-1jpp.3.el4, java-1.6.0-sun 1.6.0.15-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-demo 1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-jdbc 1.6.0.7-1jpp.3.el4, java-1.6.0-sun-src 1.6.0.15-1jpp.1.el4, +5 more Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-ibm 1.6.0.7-1jpp.2.el5, java-1.6.0-sun 1.6.0.15-1jpp.1.el5, java-1.6.0-ibm-src 1.6.0.7-1jpp.2.el5, java-1.6.0-ibm-demo 1.6.0.7-1jpp.2.el5, java-1.6.0-ibm-jdbc 1.6.0.7-1jpp.2.el5, java-1.6.0-sun-src 1.6.0.15-1jpp.1.el5, +6 morefixed: vendor fix RHSA-2009:1694
-
Red Hat Enterprise Linux WS version 4 xmlsec1 1.2.6-3.1, xmlsec1-openssl 1.2.6-3.1fixed: vendor fix RHSA-2009:1428
show 6 moreshow fewer
-
Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-ibm 1.6.0.7-1jpp.3.el4, java-1.6.0-sun 1.6.0.15-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-demo 1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-jdbc 1.6.0.7-1jpp.3.el4, java-1.6.0-sun-src 1.6.0.15-1jpp.1.el4, +5 morefixed: vendor fix RHSA-2009:1694
-
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS jgroups 2.4.7-1.ep1.el4, jcommon 1.0.16-1.1.ep1.el4, jacorb 2.3.0-1jpp.ep1.9.el4, jboss-seam 1.2.1-1.ep1.22.el4, jfreechart 1.0.13-2.3.1.ep1.el4, glassfish-jsf 1.2_13-2.1.ep1.el4, +20 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES jgroups 2.4.7-1.ep1.el4, jcommon 1.0.16-1.1.ep1.el4, jacorb 2.3.0-1jpp.ep1.9.el4, jboss-seam 1.2.1-1.ep1.22.el4, jfreechart 1.0.13-2.3.1.ep1.el4, glassfish-jsf 1.2_13-2.1.ep1.el4, +20 morefixed: vendor fix RHSA-2009:1637
-
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server jgroups 2.4.7-1.ep1.el5, jcommon 1.0.16-1.1.ep1.el5, jacorb 2.3.0-1jpp.ep1.9.1.el5, jboss-seam 1.2.1-1.ep1.14.el5, jfreechart 1.0.13-2.3.1.ep1.el5, glassfish-jsf 1.2_13-2.1.ep1.el5, +17 morefixed: vendor fix RHSA-2009:1650
-
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jgroups 2.4.7-1.ep1.el4, jcommon 1.0.16-1.1.ep1.el4, jacorb 2.3.0-1jpp.ep1.9.el4, jfreechart 1.0.13-2.3.1.ep1.el4, glassfish-jsf 1.2_13-2.1.ep1.el4, jboss-aop 1.5.5-3.CP04.2.ep1.el4, +28 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jgroups 2.4.7-1.ep1.el4, jcommon 1.0.16-1.1.ep1.el4, jacorb 2.3.0-1jpp.ep1.9.el4, jfreechart 1.0.13-2.3.1.ep1.el4, glassfish-jsf 1.2_13-2.1.ep1.el4, jboss-aop 1.5.5-3.CP04.2.ep1.el4, +28 morefixed: vendor fix RHSA-2009:1636
-
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server jgroups 2.4.7-1.ep1.el5, jcommon 1.0.16-1.1.ep1.el5, jacorb 2.3.0-1jpp.ep1.9.1.el5, jfreechart 1.0.13-2.3.1.ep1.el5, glassfish-jsf 1.2_13-2.1.ep1.el5, jboss-aop 1.5.5-3.CP04.2.ep1.el5, +25 morefixed: vendor fix RHSA-2009:1649
-
Red Hat Satellite 5.3 (RHEL v.4) java-1.6.0-ibm 1.6.0.7-1jpp.3.el4 Red Hat Satellite 5.3 (RHEL v.5) java-1.6.0-ibm 1.6.0.7-1jpp.2.el5fixed: vendor fix RHSA-2010:0043
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
6.36% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.santuario:xmlsec | >=1.4.0, <1.4.3 |
1.4.3 |
References
- git.gnome.org /cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7
-
www-01.ibm.com
/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023545&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphe
vendor-advisory, patch
-
www-01.ibm.com
/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023723&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphe
vendor-advisory, patch
-
gitlab.gnome.org
/Archive/xmlsec/-/commit/34b349675af9f72eb822837a8772cc1ead7115c7
web
-
www-01.ibm.com
/support/docview.wss?rs=180&uid=swg21384925
patch, vendor-advisory
-
securityfocus.com
/bid/35671
patch
-
vupen.com
/english/advisories/2009/1900
patch, vendor-advisory
-
vupen.com
/english/advisories/2009/1908
patch, vendor-advisory
-
vupen.com
/english/advisories/2009/1909
patch, vendor-advisory
-
vupen.com
/english/advisories/2009/1911
patch, vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2009-1428.html
vendor-advisory, web
-
gentoo.org
/security/en/glsa/glsa-201408-19.xml
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2009-1200.html
vendor-advisory
-
sunsolve.sun.com
/search/document.do?assetkey=1-66-269208-1
vendor-advisory
-
debian.org
/security/2010/dsa-1995
vendor-advisory
-
marc.info
/?l=bugtraq&m=125787273209737&w=2
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2009-1637.html
vendor-advisory
-
redhat.com
/support/errata/RHSA-2009-1694.html
vendor-advisory
-
sunsolve.sun.com
/search/document.do?assetkey=1-77-1020710.1-1
vendor-advisory
-
ubuntu.com
/usn/USN-903-1
vendor-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2009:209
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2010-03/msg00005.html
vendor-advisory
-
redhat.com
/archives/fedora-package-announce/2009-August/msg00310.html
vendor-advisory, web
-
sunsolve.sun.com
/search/document.do?assetkey=1-66-263429-1
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2009-1636.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2009-1649.html
vendor-advisory
-
redhat.com
/archives/fedora-package-announce/2009-August/msg00494.html
vendor-advisory, web
-
usn.ubuntu.com
/826-1/
vendor-advisory
-
redhat.com
/archives/fedora-package-announce/2009-August/msg00505.html
vendor-advisory, web
-
redhat.com
/archives/fedora-package-announce/2009-August/msg00325.html
vendor-advisory, web
-
lists.apple.com
/archives/security-announce/2009/Sep/msg00000.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2009-11/msg00002.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2009-1201.html
vendor-advisory
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2010/ms10-041
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2009-1650.html
vendor-advisory
-
secunia.com
/advisories/35776
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/36162
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/36494
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/35858
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/35853
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/35852
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/35854
vendor-advisory
-
secunia.com
/advisories/35855
vendor-advisory
-
secunia.com
/advisories/36176
vendor-advisory
-
secunia.com
/advisories/36180
vendor-advisory
-
mono-project.com
/Vulnerabilities
vendor-advisory
-
w3.org
/2008/06/xmldsigcore-errata.html#e03
vendor-advisory
-
w3.org
/QA/2009/07/hmac_truncation_in_xml_signatu.html
vendor-advisory
-
vupen.com
/english/advisories/2009/3122
vdb-entry
- openoffice.org /security/cves/CVE-2009-0217.html
-
issues.apache.org
/bugzilla/show_bug.cgi?id=47526
web
-
secunia.com
/advisories/60799
third-party-advisory
-
vupen.com
/english/advisories/2009/2543
vdb-entry
-
secunia.com
/advisories/38695
third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2009-0217
advisory
-
w3.org
/QA/2009/07/hmac_truncation_in_xml_signatu.html
web
-
w3.org
/2008/06/xmldsigcore-errata.html#e03
web
-
us-cert.gov
/cas/techalerts/TA09-294A.html
web
-
ubuntu.com
/usn/USN-903-1
web
-
redhat.com
/support/errata/RHSA-2009-1694.html
web
Sources
- CVE List CVE-2009-0217
- GitHub Advisory GHSA-8hfm-837h-hjg5
- NVD CVE-2009-0217
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.