Skip to content
Fencer Vulns
medium 5.5

CVE-2019-12400 json

Improper input validation in Apache Santuario XML Security for Java

published 2019-08-23 7 y ago modified 2026-06-17 4 mo ago also GHSA-4q98-wr72-h35w , EUVD-2019-0620

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits
0
none known

Summary

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.

Patch / fix

  • maven org.apache.santuario:xmlsec 2.1.4
  • apache santuario_xml_security_for_java 2.1.4
  • libxml-security-java Debian 14, Debian 13, Debian 12 2.1.7-1

debian advisories DEBIAN-CVE-2019-12400

  • eap7-txw2 jboss enterprise application platform 7.2 2.3.3-4.b02_redhat_00001.1.el8eap
  • eap7-xsom jboss enterprise application platform 7.2 2.3.3-4.b02_redhat_00001.1.el8eap
  • eap7-rngom jboss enterprise application platform 7.2 2.3.3-4.b02_redhat_00001.1.el8eap
  • eap7-thrift jboss enterprise application platform 7.2 0.13.0-1.redhat_00002.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.2 7.2.7-4.GA_redhat_00004.1.el8eap
  • eap7-jaxb-jxc jboss enterprise application platform 7.2 2.3.3-4.b02_redhat_00001.1.el8eap
  • eap7-jaxb-xjc jboss enterprise application platform 7.2 2.3.3-4.b02_redhat_00001.1.el8eap
  • eap7-codemodel jboss enterprise application platform 7.2 2.3.3-4.b02_redhat_00001.1.el8eap

red hat advisories RHSA-2020:0806RHSA-2020:0805RHSA-2020:0804

  • xml-security openSUSE Tumbleweed 2.1.7-1.1

opensuse advisories openSUSE-SU-2024:11693-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-12400 updated cvss 5.9

xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source

  • Red Hat JBoss BRMS 5 xmlsec Red Hat JBoss Data Virtualization 6 xmlsec Red Hat JBoss Enterprise Application Platform 5 xmlsec Red Hat JBoss Enterprise Application Platform 6 xmlsec Red Hat JBoss Fuse 6 xmlsec, camel-xmlsecurity camel-xmlsecurity Red Hat JBoss Fuse Service Works 6 camel-xmlsecurity camel-xmlsecurity
    +2 more products
    Red Hat JBoss Operations Network 3 xmlsec Red Hat JBoss SOA Platform 5 xmlsec
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes xmlsec
    affected: no fix available
  • Red Hat Fuse 7.7.0
    fixed: vendor fix RHSA-2020:3192
  • Red Hat JBoss EAP 7.2
    fixed: vendor fix RHSA-2020:0811
  • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-thrift 0.13.0-1.redhat_00002.1.el6eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-stax2-api 4.2.0-1.redhat_00001.1.el6eap, eap7-wildfly 7.2.7-4.GA_redhat_00004.1.el6eap, +98 more
    fixed: vendor fix RHSA-2020:0804
  • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-thrift 0.13.0-1.redhat_00002.1.el7eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-stax2-api 4.2.0-1.redhat_00001.1.el7eap, eap7-wildfly 7.2.7-4.GA_redhat_00004.1.el7eap, +100 more
    fixed: vendor fix RHSA-2020:0805
  • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-thrift 0.13.0-1.redhat_00002.1.el8eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-stax2-api 4.2.0-1.redhat_00001.1.el8eap, eap7-wildfly 7.2.7-4.GA_redhat_00004.1.el8eap, +98 more
    fixed: vendor fix RHSA-2020:0806
  • Red Hat Single Sign-On 7.3
    fixed: vendor fix RHSA-2020:0951
show 2 more
  • Red Hat Text-Only RHOAR
    fixed: vendor fix RHSA-2020:2067
  • Red Hat Decision Manager 7 xmlsec Red Hat Process Automation 7 xmlsec
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.78% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 1.9 AV:L/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.santuario:xmlsec
>=2.0.3, <2.1.4
2.1.4

Affected products

  • Apache Apache Santuario - XML Security for Java

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.