CVE-2009-0217
Vulnerability from cvelistv5
Published
2009-07-14 23:00
Modified
2024-08-07 04:24
Severity ?
Summary
The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
References
cret@cert.orghttp://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161
cret@cert.orghttp://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7
cret@cert.orghttp://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7
cret@cert.orghttp://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
cret@cert.orghttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
cret@cert.orghttp://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html
cret@cert.orghttp://marc.info/?l=bugtraq&m=125787273209737&w=2
cret@cert.orghttp://osvdb.org/55895
cret@cert.orghttp://osvdb.org/55907
cret@cert.orghttp://secunia.com/advisories/34461
cret@cert.orghttp://secunia.com/advisories/35776Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/35852Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/35853Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/35854Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/35855Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/35858Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/36162Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/36176Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/36180Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/36494Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/37300
cret@cert.orghttp://secunia.com/advisories/37671
cret@cert.orghttp://secunia.com/advisories/37841
cret@cert.orghttp://secunia.com/advisories/38567
cret@cert.orghttp://secunia.com/advisories/38568
cret@cert.orghttp://secunia.com/advisories/38695
cret@cert.orghttp://secunia.com/advisories/38921
cret@cert.orghttp://secunia.com/advisories/41818
cret@cert.orghttp://secunia.com/advisories/60799
cret@cert.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1
cret@cert.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1
cret@cert.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1
cret@cert.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1
cret@cert.orghttp://svn.apache.org/viewvc?revision=794013&view=revision
cret@cert.orghttp://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023545&loc=en_US&cs=UTF-8&lang=en&rss=ct180webspherePatch, Vendor Advisory
cret@cert.orghttp://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023723&loc=en_US&cs=UTF-8&lang=en&rss=ct180webspherePatch, Vendor Advisory
cret@cert.orghttp://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925Patch, Vendor Advisory
cret@cert.orghttp://www.aleksey.com/xmlsec/
cret@cert.orghttp://www.debian.org/security/2010/dsa-1995
cret@cert.orghttp://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
cret@cert.orghttp://www.kb.cert.org/vuls/id/466161US Government Resource
cret@cert.orghttp://www.kb.cert.org/vuls/id/MAPG-7TSKXQ
cret@cert.orghttp://www.kb.cert.org/vuls/id/WDON-7TY529
cret@cert.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2009:209
cret@cert.orghttp://www.mono-project.com/VulnerabilitiesVendor Advisory
cret@cert.orghttp://www.openoffice.org/security/cves/CVE-2009-0217.html
cret@cert.orghttp://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
cret@cert.orghttp://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
cret@cert.orghttp://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
cret@cert.orghttp://www.redhat.com/support/errata/RHSA-2009-1694.html
cret@cert.orghttp://www.securityfocus.com/bid/35671Patch
cret@cert.orghttp://www.securitytracker.com/id?1022561
cret@cert.orghttp://www.securitytracker.com/id?1022567
cret@cert.orghttp://www.securitytracker.com/id?1022661
cret@cert.orghttp://www.ubuntu.com/usn/USN-903-1
cret@cert.orghttp://www.us-cert.gov/cas/techalerts/TA09-294A.htmlUS Government Resource
cret@cert.orghttp://www.us-cert.gov/cas/techalerts/TA10-159B.htmlUS Government Resource
cret@cert.orghttp://www.vupen.com/english/advisories/2009/1900Patch, Vendor Advisory
cret@cert.orghttp://www.vupen.com/english/advisories/2009/1908Patch, Vendor Advisory
cret@cert.orghttp://www.vupen.com/english/advisories/2009/1909Patch, Vendor Advisory
cret@cert.orghttp://www.vupen.com/english/advisories/2009/1911Patch, Vendor Advisory
cret@cert.orghttp://www.vupen.com/english/advisories/2009/2543
cret@cert.orghttp://www.vupen.com/english/advisories/2009/3122
cret@cert.orghttp://www.vupen.com/english/advisories/2010/0366
cret@cert.orghttp://www.vupen.com/english/advisories/2010/0635
cret@cert.orghttp://www.w3.org/2008/06/xmldsigcore-errata.html#e03Vendor Advisory
cret@cert.orghttp://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.htmlVendor Advisory
cret@cert.orghttps://bugzilla.redhat.com/show_bug.cgi?id=511915
cret@cert.orghttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041
cret@cert.orghttps://issues.apache.org/bugzilla/show_bug.cgi?id=47526
cret@cert.orghttps://issues.apache.org/bugzilla/show_bug.cgi?id=47527
cret@cert.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186
cret@cert.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158
cret@cert.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1200.html
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1201.html
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1428.html
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1636.html
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1637.html
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1649.html
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1650.html
cret@cert.orghttps://usn.ubuntu.com/826-1/
cret@cert.orghttps://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
cret@cert.orghttps://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
cret@cert.orghttps://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html
cret@cert.orghttps://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html
Impacted products
n/an/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:24:18.400Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2009:1428",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1428.html"
          },
          {
            "name": "ADV-2009-3122",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3122"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.openoffice.org/security/cves/CVE-2009-0217.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526"
          },
          {
            "name": "60799",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60799"
          },
          {
            "name": "GLSA-201408-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml"
          },
          {
            "name": "PK80596",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023545\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
          },
          {
            "name": "RHSA-2009:1200",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
          },
          {
            "name": "35776",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35776"
          },
          {
            "name": "36162",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36162"
          },
          {
            "name": "36494",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36494"
          },
          {
            "name": "ADV-2009-2543",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "35858",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35858"
          },
          {
            "name": "38695",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38695"
          },
          {
            "name": "269208",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1"
          },
          {
            "name": "DSA-1995",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2010/dsa-1995"
          },
          {
            "name": "HPSBUX02476",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "35853",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35853"
          },
          {
            "name": "RHSA-2009:1637",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html"
          },
          {
            "name": "RHSA-2009:1694",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2009-1694.html"
          },
          {
            "name": "35852",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35852"
          },
          {
            "name": "35854",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35854"
          },
          {
            "name": "34461",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34461"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/WDON-7TY529"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mono-project.com/Vulnerabilities"
          },
          {
            "name": "1020710",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1"
          },
          {
            "name": "USN-903-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-903-1"
          },
          {
            "name": "35671",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35671"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527"
          },
          {
            "name": "ADV-2010-0366",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/0366"
          },
          {
            "name": "55907",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/55907"
          },
          {
            "name": "MDVSA-2009:209",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
          },
          {
            "name": "SUSE-SA:2010:017",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html"
          },
          {
            "name": "38567",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38567"
          },
          {
            "name": "FEDORA-2009-8329",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
          },
          {
            "name": "263429",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161"
          },
          {
            "name": "SSRT090250",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "ADV-2009-1900",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1900"
          },
          {
            "name": "1022561",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022561"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
          },
          {
            "name": "37671",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37671"
          },
          {
            "name": "VU#466161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/466161"
          },
          {
            "name": "1022567",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022567"
          },
          {
            "name": "RHSA-2009:1636",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html"
          },
          {
            "name": "PK80627",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023723\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
          },
          {
            "name": "RHSA-2009:1649",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html"
          },
          {
            "name": "TA09-294A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
          },
          {
            "name": "ADV-2009-1909",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1909"
          },
          {
            "name": "ADV-2010-0635",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/0635"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision"
          },
          {
            "name": "38568",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38568"
          },
          {
            "name": "36180",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "name": "FEDORA-2009-8456",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03"
          },
          {
            "name": "USN-826-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/826-1/"
          },
          {
            "name": "37841",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37841"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
          },
          {
            "name": "35855",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35855"
          },
          {
            "name": "FEDORA-2009-8473",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html"
          },
          {
            "name": "36176",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36176"
          },
          {
            "name": "oval:org.mitre.oval:def:7158",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html"
          },
          {
            "name": "ADV-2009-1908",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1908"
          },
          {
            "name": "FEDORA-2009-8337",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925"
          },
          {
            "name": "41818",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/41818"
          },
          {
            "name": "1022661",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022661"
          },
          {
            "name": "37300",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37300"
          },
          {
            "name": "ADV-2009-1911",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1911"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "SUSE-SA:2009:053",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
          },
          {
            "name": "oval:org.mitre.oval:def:8717",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717"
          },
          {
            "name": "RHSA-2009:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ"
          },
          {
            "name": "TA10-159B",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"
          },
          {
            "name": "oval:org.mitre.oval:def:10186",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186"
          },
          {
            "name": "55895",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/55895"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.aleksey.com/xmlsec/"
          },
          {
            "name": "MS10-041",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041"
          },
          {
            "name": "38921",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38921"
          },
          {
            "name": "RHSA-2009:1650",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-07-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "name": "RHSA-2009:1428",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1428.html"
        },
        {
          "name": "ADV-2009-3122",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3122"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.openoffice.org/security/cves/CVE-2009-0217.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526"
        },
        {
          "name": "60799",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60799"
        },
        {
          "name": "GLSA-201408-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml"
        },
        {
          "name": "PK80596",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023545\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
        },
        {
          "name": "RHSA-2009:1200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
        },
        {
          "name": "35776",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35776"
        },
        {
          "name": "36162",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36162"
        },
        {
          "name": "36494",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36494"
        },
        {
          "name": "ADV-2009-2543",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2543"
        },
        {
          "name": "35858",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35858"
        },
        {
          "name": "38695",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38695"
        },
        {
          "name": "269208",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1"
        },
        {
          "name": "DSA-1995",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2010/dsa-1995"
        },
        {
          "name": "HPSBUX02476",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "35853",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35853"
        },
        {
          "name": "RHSA-2009:1637",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html"
        },
        {
          "name": "RHSA-2009:1694",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2009-1694.html"
        },
        {
          "name": "35852",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35852"
        },
        {
          "name": "35854",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35854"
        },
        {
          "name": "34461",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34461"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.kb.cert.org/vuls/id/WDON-7TY529"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mono-project.com/Vulnerabilities"
        },
        {
          "name": "1020710",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1"
        },
        {
          "name": "USN-903-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-903-1"
        },
        {
          "name": "35671",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35671"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527"
        },
        {
          "name": "ADV-2010-0366",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/0366"
        },
        {
          "name": "55907",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/55907"
        },
        {
          "name": "MDVSA-2009:209",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
        },
        {
          "name": "SUSE-SA:2010:017",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html"
        },
        {
          "name": "38567",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38567"
        },
        {
          "name": "FEDORA-2009-8329",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
        },
        {
          "name": "263429",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161"
        },
        {
          "name": "SSRT090250",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
        },
        {
          "name": "ADV-2009-1900",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1900"
        },
        {
          "name": "1022561",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022561"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
        },
        {
          "name": "37671",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37671"
        },
        {
          "name": "VU#466161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/466161"
        },
        {
          "name": "1022567",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022567"
        },
        {
          "name": "RHSA-2009:1636",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html"
        },
        {
          "name": "PK80627",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023723\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
        },
        {
          "name": "RHSA-2009:1649",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html"
        },
        {
          "name": "TA09-294A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
        },
        {
          "name": "ADV-2009-1909",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1909"
        },
        {
          "name": "ADV-2010-0635",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/0635"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision"
        },
        {
          "name": "38568",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38568"
        },
        {
          "name": "36180",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36180"
        },
        {
          "name": "FEDORA-2009-8456",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03"
        },
        {
          "name": "USN-826-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/826-1/"
        },
        {
          "name": "37841",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37841"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
        },
        {
          "name": "35855",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35855"
        },
        {
          "name": "FEDORA-2009-8473",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html"
        },
        {
          "name": "36176",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36176"
        },
        {
          "name": "oval:org.mitre.oval:def:7158",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html"
        },
        {
          "name": "ADV-2009-1908",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1908"
        },
        {
          "name": "FEDORA-2009-8337",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925"
        },
        {
          "name": "41818",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/41818"
        },
        {
          "name": "1022661",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022661"
        },
        {
          "name": "37300",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37300"
        },
        {
          "name": "ADV-2009-1911",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1911"
        },
        {
          "name": "APPLE-SA-2009-09-03-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
        },
        {
          "name": "SUSE-SA:2009:053",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
        },
        {
          "name": "oval:org.mitre.oval:def:8717",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717"
        },
        {
          "name": "RHSA-2009:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ"
        },
        {
          "name": "TA10-159B",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"
        },
        {
          "name": "oval:org.mitre.oval:def:10186",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186"
        },
        {
          "name": "55895",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/55895"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.aleksey.com/xmlsec/"
        },
        {
          "name": "MS10-041",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041"
        },
        {
          "name": "38921",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38921"
        },
        {
          "name": "RHSA-2009:1650",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2009-0217",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2009:1428",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1428.html"
            },
            {
              "name": "ADV-2009-3122",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/3122"
            },
            {
              "name": "http://www.openoffice.org/security/cves/CVE-2009-0217.html",
              "refsource": "CONFIRM",
              "url": "http://www.openoffice.org/security/cves/CVE-2009-0217.html"
            },
            {
              "name": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526",
              "refsource": "CONFIRM",
              "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526"
            },
            {
              "name": "60799",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60799"
            },
            {
              "name": "GLSA-201408-19",
              "refsource": "GENTOO",
              "url": "http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml"
            },
            {
              "name": "PK80596",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023545\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
            },
            {
              "name": "RHSA-2009:1200",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
            },
            {
              "name": "35776",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35776"
            },
            {
              "name": "36162",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36162"
            },
            {
              "name": "36494",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36494"
            },
            {
              "name": "ADV-2009-2543",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2543"
            },
            {
              "name": "35858",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35858"
            },
            {
              "name": "38695",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38695"
            },
            {
              "name": "269208",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1"
            },
            {
              "name": "DSA-1995",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2010/dsa-1995"
            },
            {
              "name": "HPSBUX02476",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "35853",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35853"
            },
            {
              "name": "RHSA-2009:1637",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html"
            },
            {
              "name": "RHSA-2009:1694",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2009-1694.html"
            },
            {
              "name": "35852",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35852"
            },
            {
              "name": "35854",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35854"
            },
            {
              "name": "34461",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34461"
            },
            {
              "name": "http://www.kb.cert.org/vuls/id/WDON-7TY529",
              "refsource": "CONFIRM",
              "url": "http://www.kb.cert.org/vuls/id/WDON-7TY529"
            },
            {
              "name": "http://www.mono-project.com/Vulnerabilities",
              "refsource": "CONFIRM",
              "url": "http://www.mono-project.com/Vulnerabilities"
            },
            {
              "name": "1020710",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1"
            },
            {
              "name": "USN-903-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-903-1"
            },
            {
              "name": "35671",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/35671"
            },
            {
              "name": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527",
              "refsource": "CONFIRM",
              "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527"
            },
            {
              "name": "ADV-2010-0366",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/0366"
            },
            {
              "name": "55907",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/55907"
            },
            {
              "name": "MDVSA-2009:209",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
            },
            {
              "name": "SUSE-SA:2010:017",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html"
            },
            {
              "name": "38567",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38567"
            },
            {
              "name": "FEDORA-2009-8329",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
            },
            {
              "name": "263429",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1"
            },
            {
              "name": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161",
              "refsource": "CONFIRM",
              "url": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161"
            },
            {
              "name": "SSRT090250",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "ADV-2009-1900",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1900"
            },
            {
              "name": "1022561",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022561"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
            },
            {
              "name": "37671",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37671"
            },
            {
              "name": "VU#466161",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/466161"
            },
            {
              "name": "1022567",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022567"
            },
            {
              "name": "RHSA-2009:1636",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html"
            },
            {
              "name": "PK80627",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023723\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
            },
            {
              "name": "RHSA-2009:1649",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html"
            },
            {
              "name": "TA09-294A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
            },
            {
              "name": "ADV-2009-1909",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1909"
            },
            {
              "name": "ADV-2010-0635",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/0635"
            },
            {
              "name": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision"
            },
            {
              "name": "38568",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38568"
            },
            {
              "name": "36180",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36180"
            },
            {
              "name": "FEDORA-2009-8456",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html"
            },
            {
              "name": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03",
              "refsource": "CONFIRM",
              "url": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03"
            },
            {
              "name": "USN-826-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/826-1/"
            },
            {
              "name": "37841",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37841"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
            },
            {
              "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
              "refsource": "CONFIRM",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
            },
            {
              "name": "35855",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35855"
            },
            {
              "name": "FEDORA-2009-8473",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html"
            },
            {
              "name": "36176",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36176"
            },
            {
              "name": "oval:org.mitre.oval:def:7158",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158"
            },
            {
              "name": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html",
              "refsource": "MISC",
              "url": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html"
            },
            {
              "name": "ADV-2009-1908",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1908"
            },
            {
              "name": "FEDORA-2009-8337",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
            },
            {
              "name": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7",
              "refsource": "CONFIRM",
              "url": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925"
            },
            {
              "name": "41818",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/41818"
            },
            {
              "name": "1022661",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022661"
            },
            {
              "name": "37300",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37300"
            },
            {
              "name": "ADV-2009-1911",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1911"
            },
            {
              "name": "APPLE-SA-2009-09-03-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
            },
            {
              "name": "SUSE-SA:2009:053",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
            },
            {
              "name": "oval:org.mitre.oval:def:8717",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717"
            },
            {
              "name": "RHSA-2009:1201",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
            },
            {
              "name": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7",
              "refsource": "CONFIRM",
              "url": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
            },
            {
              "name": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ",
              "refsource": "CONFIRM",
              "url": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ"
            },
            {
              "name": "TA10-159B",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"
            },
            {
              "name": "oval:org.mitre.oval:def:10186",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186"
            },
            {
              "name": "55895",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/55895"
            },
            {
              "name": "http://www.aleksey.com/xmlsec/",
              "refsource": "CONFIRM",
              "url": "http://www.aleksey.com/xmlsec/"
            },
            {
              "name": "MS10-041",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041"
            },
            {
              "name": "38921",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38921"
            },
            {
              "name": "RHSA-2009:1650",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=511915",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2009-0217",
    "datePublished": "2009-07-14T23:00:00",
    "dateReserved": "2009-01-20T00:00:00",
    "dateUpdated": "2024-08-07T04:24:18.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2009-0217\",\"sourceIdentifier\":\"cret@cert.org\",\"published\":\"2009-07-14T23:30:00.187\",\"lastModified\":\"2018-10-12T21:49:44.190\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.\"},{\"lang\":\"es\",\"value\":\"El dise\u00f1o de la recomendaci\u00f3n de W3C XML Signature Syntax and Processing (XMLDsig), tal y como es implementado en productos que incluyen (1) el componente Oracle Security Developer Tools de Application Server de Oracle en versiones 10.1.2.3, 10.1.3.4 y 10.1.4.3IM; (2) el componente WebLogic Server de Product Suite de BEA en las versiones 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0 y 8.1 SP6; (3) Mono anterior a versi\u00f3n 2.4.2.2; (4) XML Security Library anterior a versi\u00f3n 1.2.12; (5) WebSphere Application Server de IBM versiones 6.0 hasta 6.0.2.33, versiones 6.1 hasta 6.1.0.23 y versiones 7.0 hasta 7.0.0.1; (6) JDK y JRE de Sun Update 14 y versiones anteriores; (7) .NET Framework de Microsoft versiones 3.0 hasta 3.0 SP2, versiones 3.5 y 4.0; y otros productos utilizan un par\u00e1metro que define una longitud de truncamiento HMAC (HMACOutputLength) pero no requiere un m\u00ednimo para esta longitud, lo que permite a los atacantes suplantar firmas basadas en HMAC y omitir la autenticaci\u00f3n mediante la especificaci\u00f3n de una longitud de truncamiento con un peque\u00f1o n\u00famero de bits.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"01F45BA3-6504-47AF-B757-7B6D3526FBF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3E6D6AF-0D69-4605-B871-6DAE01CF08EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5EE7744-4584-4AE4-9F27-11EFAA002E77\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0DE0C501-4062-49D0-8983-5E92765C7181\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE27E903-6D65-4D29-9583-43FB4CB473B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A754DD5-585B-4E89-9C01-2B47D2F5F6F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D40DEF90-CE7F-46BB-A6FF-50C1797866B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5AAA544-D3F8-4AE2-BB2D-A64CB86EC988\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C7D4ECD-8787-4F9B-B81C-C0DFD8DD20EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.1.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C43D3515-D9F5-4DC8-A030-9F97593495F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.1.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1968803-FF03-477C-81FE-87528FC6DF6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.1.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"62C1CA3B-E575-4531-A336-8BFC9F5DEC26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.1.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6C130982-8C6E-413E-8296-C9C277FCBE6D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.1.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E1790E4-073A-4666-80CB-4D967928A0BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.1.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6239EEAE-5852-4DF7-8627-87139BBB03B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"714C405D-1E8F-45C1-8A09-5103F0080C76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:fp17:*:*:*:*:*\",\"matchCriteriaId\":\"D592217D-3489-40AE-8338-BF5AA5BBA251\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C7F31FD3-8681-4F07-9644-5CC87D512520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2604E01-E43E-4882-8896-5E646E850286\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"458BAD79-958E-4665-B1F8-0D46E0C57045\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A98E5593-1534-48E2-8CD5-B2D1CACDDAB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB4AB6BD-4439-4100-A3CE-4600AED10B65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD71D5EA-9AF5-422C-810A-D136A5F132F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"375DF4AF-3C7C-47C3-BBB8-AF2B3827AC13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C9D6BDA-39E1-4D15-9D86-E212809998FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"91CC2DA7-BAA6-4061-8D0C-81F002DEF06D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F2A78FE-8FA6-4532-9E9E-CF6F860EFAE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59BEDD70-B6DB-448F-A998-3E8774B0DB8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"63099EF9-0512-44CD-946A-9B25144E50D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F200042C-D45E-4CAD-BF6E-E3DADF4D1D21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9132BB1-5E2E-4CA6-9B63-027CF2A7229D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D839EDB9-A44F-4F7F-94EF-1A77371D705C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4421929D-C4B9-43C5-BE61-E68484D3B198\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB622117-C91F-47D2-9832-B7DB340796E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D65E0CC-FA8C-41FD-B256-47DB0C9757FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D87691D-0719-4447-B258-5FA2BD10F11A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D0B1A00-191D-49B2-8841-FB6C48A5D0C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF771E28-65AC-4A94-8A51-4EA77BC3D0B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5594891-E790-44E7-BC9E-0A413B385E1B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C286007A-361F-47BB-A099-E041D5CF6E48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD464F13-942D-40EC-8144-6D23A0AEAA81\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.0.2.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"05BC8C52-DA95-4BF2-AD47-9922741CAAF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7B9CDD56-921C-4FAF-87E2-14B91EC1A93D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"95255265-6D69-46D3-9FFA-8EDB1734375C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E4191D3-64AB-482C-9DEF-DD04C4C942CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FC6EB31-9707-408B-8BF5-66BD23441A75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9B73E052-AF4F-4543-AA03-F5B1FA976EA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"23171B81-C991-467A-95A4-EDDAC59C37BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CBD75308-7F21-4DDF-AD66-C155CF4B721B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2586C584-3258-414B-AB28-1EBA0DBD0B83\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"431C250D-8279-4071-871C-1C7C4DE09B5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BCA175EA-EDC6-4228-8E28-E9BBC981E60A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC300B03-7A8F-4E96-B55D-18CC258BBFCF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6A4EC9D-98C2-40B0-BA40-4838FE8D1FF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3A3ADFB-93E0-42E5-B31B-59F22EA4E3EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7AF5BB33-4E78-4123-8093-EBEE2F2B5598\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3F4B8EA-9299-42C1-AAFB-831701ED2FA2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A45B6F32-5DFF-4833-9F0F-89576724CF97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"13C8054A-8581-4936-AF94-291AE56EB4DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"13CA9A59-DFE4-4566-8719-E6FA4720F06A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"026EBFCD-0BC1-404B-BC14-292F35BE667A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A89DD1BF-4AB0-480D-9856-B1BEA73A4AAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B13D74F8-4321-48B3-A33E-FCCFA93013CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49E119EF-B6A5-4B6C-B199-C64F62CA7CB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2043B836-3950-46A1-89E4-08985DEA0D33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9C8FA3D-9162-4D9B-8250-FAC93ED77A2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5EE93B7F-3EB5-4BE4-BFAA-4AA30D15A76D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:6.1.0.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E06DE5D4-D3A5-4783-ACE0-A80808DB09C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0905C80-A1BA-49CD-90CA-9270ECC3940C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B108457A-50DC-4432-9E30-98ADBEBF2389\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mono_project:mono:1.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"403E554C-FD1B-42CE-82C2-43CC191905DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mono_project:mono:1.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"78278FE6-26EA-4E89-9423-EABA6C4D8877\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mono_project:mono:1.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"15E1695E-FD6E-4602-9BD9-9CFFF20574CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mono_project:mono:1.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"691B3AF1-7F3F-4A7D-9F16-FE6044E33482\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mono_project:mono:1.2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2DE3739-A2ED-47D7-9AE9-442A95ACFC3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mono_project:mono:1.2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DDAB5331-AD2E-483C-93C3-8095BBBA0572\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mono_project:mono:1.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3CC03DC-14A6-4C45-9511-7CE8E7F727BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mono_project:mono:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C71A1398-8AA5-4AB3-89C8-E2E2B36FA5AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:application_server:10.1.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"96C617ED-3D8C-4B64-A56A-30BDE6E9B8D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:application_server:10.1.3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D41A0A9E-6B5B-4FA9-996B-E589B96C24D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:application_server:10.1.4.3im:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25672ED0-9830-48B3-899A-405B97E2229A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:bea_product_suite:8.1:sp6:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B8AB045-051A-477E-B2F7-4057826C43F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:bea_product_suite:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B5D9ABA-10EE-4EE2-9814-BDFBBE9A6014\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:bea_product_suite:9.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"09215858-8A4F-4595-98DD-39027EC6CC1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:bea_product_suite:9.2:mp3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7390B6A-7944-4509-B499-5B51DB9BF42E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:bea_product_suite:10.0:mp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"193516AD-8096-4A6E-9C4B-4B9717DD7021\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:bea_product_suite:10.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B1C64BD-7C8C-4B28-9EA8-5198B6C71AD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server_component:8.1:sp6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3B986B9-A82B-4087-808E-854EC443AC3C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server_component:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AF95249-8970-406B-B874-4B9925471C27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server_component:9.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD536DD6-AF76-4075-8B28-322FB65793AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server_component:9.2:mp3:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BDA1940-A3F4-4CEC-BDD0-B098B2E27CE5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server_component:10.0:mp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3BB8A45D-95E5-4F14-A51A-29B5A6E45F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server_component:10.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E3D253B-73D7-4916-B5E4-9D553741E98C\"}]}]}],\"references\":[{\"url\":\"http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161\",\"source\":\"cret@cert.org\"},{\"url\":\"http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7\",\"source\":\"cret@cert.org\"},{\"url\":\"http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7\",\"source\":\"cret@cert.org\"},{\"url\":\"http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html\",\"source\":\"cret@cert.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html\",\"source\":\"cret@cert.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html\",\"source\":\"cret@cert.org\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2\",\"source\":\"cret@cert.org\"},{\"url\":\"http://osvdb.org/55895\",\"source\":\"cret@cert.org\"},{\"url\":\"http://osvdb.org/55907\",\"source\":\"cret@cert.org\"},{\"url\":\"http://secunia.com/advisories/34461\",\"source\":\"cret@cert.org\"},{\"url\":\"http://secunia.com/advisories/35776\",\"source\":\"cret@cert.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35852\",\"source\":\"cret@cert.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35853\",\"source\":\"cret@cert.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35854\",\"source\":\"cret@cert.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35855\",\"source\":\"cret@cert.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35858\",\"source\":\"cret@cert.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/36162\",\"source\":\"cret@cert.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/36176\",\"source\":\"cret@cert.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/36180\",\"source\":\"cret@cert.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/36494\",\"source\":\"cret@cert.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/37300\",\"source\":\"cret@cert.org\"},{\"url\":\"http://secunia.com/advisories/37671\",\"source\":\"cret@cert.org\"},{\"url\":\"http://secunia.com/advisories/37841\",\"source\":\"cret@cert.org\"},{\"url\":\"http://secunia.com/advisories/38567\",\"source\":\"cret@cert.org\"},{\"url\":\"http://secunia.com/advisories/38568\",\"source\":\"cret@cert.org\"},{\"url\":\"http://secunia.com/advisories/38695\",\"source\":\"cret@cert.org\"},{\"url\":\"http://secunia.com/advisories/38921\",\"source\":\"cret@cert.org\"},{\"url\":\"http://secunia.com/advisories/41818\",\"source\":\"cret@cert.org\"},{\"url\":\"http://secunia.com/advisories/60799\",\"source\":\"cret@cert.org\"},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1\",\"source\":\"cret@cert.org\"},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1\",\"source\":\"cret@cert.org\"},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1\",\"source\":\"cret@cert.org\"},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1\",\"source\":\"cret@cert.org\"},{\"url\":\"http://svn.apache.org/viewvc?revision=794013\u0026view=revision\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023545\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere\",\"source\":\"cret@cert.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023723\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere\",\"source\":\"cret@cert.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925\",\"source\":\"cret@cert.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.aleksey.com/xmlsec/\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.debian.org/security/2010/dsa-1995\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.kb.cert.org/vuls/id/466161\",\"source\":\"cret@cert.org\",\"tags\":[\"US Government Resource\"]},{\"url\":\"http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.kb.cert.org/vuls/id/WDON-7TY529\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2009:209\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.mono-project.com/Vulnerabilities\",\"source\":\"cret@cert.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openoffice.org/security/cves/CVE-2009-0217.html\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2009-1694.html\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.securityfocus.com/bid/35671\",\"source\":\"cret@cert.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.securitytracker.com/id?1022561\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.securitytracker.com/id?1022567\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.securitytracker.com/id?1022661\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.ubuntu.com/usn/USN-903-1\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.us-cert.gov/cas/techalerts/TA09-294A.html\",\"source\":\"cret@cert.org\",\"tags\":[\"US Government Resource\"]},{\"url\":\"http://www.us-cert.gov/cas/techalerts/TA10-159B.html\",\"source\":\"cret@cert.org\",\"tags\":[\"US Government Resource\"]},{\"url\":\"http://www.vupen.com/english/advisories/2009/1900\",\"source\":\"cret@cert.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2009/1908\",\"source\":\"cret@cert.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2009/1909\",\"source\":\"cret@cert.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2009/1911\",\"source\":\"cret@cert.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2009/2543\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/3122\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2010/0366\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2010/0635\",\"source\":\"cret@cert.org\"},{\"url\":\"http://www.w3.org/2008/06/xmldsigcore-errata.html#e03\",\"source\":\"cret@cert.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html\",\"source\":\"cret@cert.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=511915\",\"source\":\"cret@cert.org\"},{\"url\":\"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041\",\"source\":\"cret@cert.org\"},{\"url\":\"https://issues.apache.org/bugzilla/show_bug.cgi?id=47526\",\"source\":\"cret@cert.org\"},{\"url\":\"https://issues.apache.org/bugzilla/show_bug.cgi?id=47527\",\"source\":\"cret@cert.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186\",\"source\":\"cret@cert.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158\",\"source\":\"cret@cert.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717\",\"source\":\"cret@cert.org\"},{\"url\":\"https://rhn.redhat.com/errata/RHSA-2009-1200.html\",\"source\":\"cret@cert.org\"},{\"url\":\"https://rhn.redhat.com/errata/RHSA-2009-1201.html\",\"source\":\"cret@cert.org\"},{\"url\":\"https://rhn.redhat.com/errata/RHSA-2009-1428.html\",\"source\":\"cret@cert.org\"},{\"url\":\"https://rhn.redhat.com/errata/RHSA-2009-1636.html\",\"source\":\"cret@cert.org\"},{\"url\":\"https://rhn.redhat.com/errata/RHSA-2009-1637.html\",\"source\":\"cret@cert.org\"},{\"url\":\"https://rhn.redhat.com/errata/RHSA-2009-1649.html\",\"source\":\"cret@cert.org\"},{\"url\":\"https://rhn.redhat.com/errata/RHSA-2009-1650.html\",\"source\":\"cret@cert.org\"},{\"url\":\"https://usn.ubuntu.com/826-1/\",\"source\":\"cret@cert.org\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html\",\"source\":\"cret@cert.org\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html\",\"source\":\"cret@cert.org\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html\",\"source\":\"cret@cert.org\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html\",\"source\":\"cret@cert.org\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.