fkie_cve-2009-0217
Vulnerability from fkie_nvd
Published
2009-07-14 23:30
Modified
2024-11-21 00:59
Severity ?
Summary
The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
References
cret@cert.orghttp://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161
cret@cert.orghttp://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7
cret@cert.orghttp://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7
cret@cert.orghttp://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
cret@cert.orghttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
cret@cert.orghttp://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html
cret@cert.orghttp://marc.info/?l=bugtraq&m=125787273209737&w=2
cret@cert.orghttp://marc.info/?l=bugtraq&m=125787273209737&w=2
cret@cert.orghttp://osvdb.org/55895
cret@cert.orghttp://osvdb.org/55907
cret@cert.orghttp://secunia.com/advisories/34461
cret@cert.orghttp://secunia.com/advisories/35776Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/35852Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/35853Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/35854Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/35855Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/35858Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/36162Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/36176Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/36180Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/36494Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/37300
cret@cert.orghttp://secunia.com/advisories/37671
cret@cert.orghttp://secunia.com/advisories/37841
cret@cert.orghttp://secunia.com/advisories/38567
cret@cert.orghttp://secunia.com/advisories/38568
cret@cert.orghttp://secunia.com/advisories/38695
cret@cert.orghttp://secunia.com/advisories/38921
cret@cert.orghttp://secunia.com/advisories/41818
cret@cert.orghttp://secunia.com/advisories/60799
cret@cert.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1
cret@cert.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1
cret@cert.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1
cret@cert.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1
cret@cert.orghttp://svn.apache.org/viewvc?revision=794013&view=revision
cret@cert.orghttp://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023545&loc=en_US&cs=UTF-8&lang=en&rss=ct180webspherePatch, Vendor Advisory
cret@cert.orghttp://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023723&loc=en_US&cs=UTF-8&lang=en&rss=ct180webspherePatch, Vendor Advisory
cret@cert.orghttp://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925Patch, Vendor Advisory
cret@cert.orghttp://www.aleksey.com/xmlsec/
cret@cert.orghttp://www.debian.org/security/2010/dsa-1995
cret@cert.orghttp://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
cret@cert.orghttp://www.kb.cert.org/vuls/id/466161US Government Resource
cret@cert.orghttp://www.kb.cert.org/vuls/id/MAPG-7TSKXQ
cret@cert.orghttp://www.kb.cert.org/vuls/id/WDON-7TY529
cret@cert.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2009:209
cret@cert.orghttp://www.mono-project.com/VulnerabilitiesVendor Advisory
cret@cert.orghttp://www.openoffice.org/security/cves/CVE-2009-0217.html
cret@cert.orghttp://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
cret@cert.orghttp://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
cret@cert.orghttp://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
cret@cert.orghttp://www.redhat.com/support/errata/RHSA-2009-1694.html
cret@cert.orghttp://www.securityfocus.com/bid/35671Patch
cret@cert.orghttp://www.securitytracker.com/id?1022561
cret@cert.orghttp://www.securitytracker.com/id?1022567
cret@cert.orghttp://www.securitytracker.com/id?1022661
cret@cert.orghttp://www.ubuntu.com/usn/USN-903-1
cret@cert.orghttp://www.us-cert.gov/cas/techalerts/TA09-294A.htmlUS Government Resource
cret@cert.orghttp://www.us-cert.gov/cas/techalerts/TA10-159B.htmlUS Government Resource
cret@cert.orghttp://www.vupen.com/english/advisories/2009/1900Patch, Vendor Advisory
cret@cert.orghttp://www.vupen.com/english/advisories/2009/1908Patch, Vendor Advisory
cret@cert.orghttp://www.vupen.com/english/advisories/2009/1909Patch, Vendor Advisory
cret@cert.orghttp://www.vupen.com/english/advisories/2009/1911Patch, Vendor Advisory
cret@cert.orghttp://www.vupen.com/english/advisories/2009/2543
cret@cert.orghttp://www.vupen.com/english/advisories/2009/3122
cret@cert.orghttp://www.vupen.com/english/advisories/2010/0366
cret@cert.orghttp://www.vupen.com/english/advisories/2010/0635
cret@cert.orghttp://www.w3.org/2008/06/xmldsigcore-errata.html#e03Vendor Advisory
cret@cert.orghttp://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.htmlVendor Advisory
cret@cert.orghttps://bugzilla.redhat.com/show_bug.cgi?id=511915
cret@cert.orghttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041
cret@cert.orghttps://issues.apache.org/bugzilla/show_bug.cgi?id=47526
cret@cert.orghttps://issues.apache.org/bugzilla/show_bug.cgi?id=47527
cret@cert.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186
cret@cert.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158
cret@cert.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1200.html
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1201.html
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1428.html
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1636.html
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1637.html
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1649.html
cret@cert.orghttps://rhn.redhat.com/errata/RHSA-2009-1650.html
cret@cert.orghttps://usn.ubuntu.com/826-1/
cret@cert.orghttps://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
cret@cert.orghttps://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
cret@cert.orghttps://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html
cret@cert.orghttps://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html
af854a3a-2127-422b-91ae-364da2661108http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161
af854a3a-2127-422b-91ae-364da2661108http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7
af854a3a-2127-422b-91ae-364da2661108http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=125787273209737&w=2
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=125787273209737&w=2
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/55895
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/55907
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34461
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35776Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35852Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35853Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35854Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35855Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35858Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36162Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36176Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36180Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36494Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/37300
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/37671
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/37841
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/38567
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/38568
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/38695
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/38921
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/41818
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/60799
af854a3a-2127-422b-91ae-364da2661108http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1
af854a3a-2127-422b-91ae-364da2661108http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1
af854a3a-2127-422b-91ae-364da2661108http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1
af854a3a-2127-422b-91ae-364da2661108http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?revision=794013&view=revision
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023545&loc=en_US&cs=UTF-8&lang=en&rss=ct180webspherePatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023723&loc=en_US&cs=UTF-8&lang=en&rss=ct180webspherePatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.aleksey.com/xmlsec/
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2010/dsa-1995
af854a3a-2127-422b-91ae-364da2661108http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/466161US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/WDON-7TY529
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
af854a3a-2127-422b-91ae-364da2661108http://www.mono-project.com/VulnerabilitiesVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openoffice.org/security/cves/CVE-2009-0217.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2009-1694.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/35671Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1022561
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1022567
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1022661
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-903-1
af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/cas/techalerts/TA09-294A.htmlUS Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/cas/techalerts/TA10-159B.htmlUS Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1900Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1908Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1909Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1911Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/2543
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/3122
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/0366
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/0635
af854a3a-2127-422b-91ae-364da2661108http://www.w3.org/2008/06/xmldsigcore-errata.html#e03Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=511915
af854a3a-2127-422b-91ae-364da2661108https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041
af854a3a-2127-422b-91ae-364da2661108https://issues.apache.org/bugzilla/show_bug.cgi?id=47526
af854a3a-2127-422b-91ae-364da2661108https://issues.apache.org/bugzilla/show_bug.cgi?id=47527
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717
af854a3a-2127-422b-91ae-364da2661108https://rhn.redhat.com/errata/RHSA-2009-1200.html
af854a3a-2127-422b-91ae-364da2661108https://rhn.redhat.com/errata/RHSA-2009-1201.html
af854a3a-2127-422b-91ae-364da2661108https://rhn.redhat.com/errata/RHSA-2009-1428.html
af854a3a-2127-422b-91ae-364da2661108https://rhn.redhat.com/errata/RHSA-2009-1636.html
af854a3a-2127-422b-91ae-364da2661108https://rhn.redhat.com/errata/RHSA-2009-1637.html
af854a3a-2127-422b-91ae-364da2661108https://rhn.redhat.com/errata/RHSA-2009-1649.html
af854a3a-2127-422b-91ae-364da2661108https://rhn.redhat.com/errata/RHSA-2009-1650.html
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/826-1/
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html
Impacted products
Vendor Product Version
ibm websphere_application_server 6.0
ibm websphere_application_server 6.0.0.1
ibm websphere_application_server 6.0.0.2
ibm websphere_application_server 6.0.0.3
ibm websphere_application_server 6.0.1
ibm websphere_application_server 6.0.1.1
ibm websphere_application_server 6.0.1.2
ibm websphere_application_server 6.0.1.3
ibm websphere_application_server 6.0.1.5
ibm websphere_application_server 6.0.1.7
ibm websphere_application_server 6.0.1.9
ibm websphere_application_server 6.0.1.11
ibm websphere_application_server 6.0.1.13
ibm websphere_application_server 6.0.1.15
ibm websphere_application_server 6.0.1.17
ibm websphere_application_server 6.0.2
ibm websphere_application_server 6.0.2
ibm websphere_application_server 6.0.2.1
ibm websphere_application_server 6.0.2.2
ibm websphere_application_server 6.0.2.3
ibm websphere_application_server 6.0.2.10
ibm websphere_application_server 6.0.2.11
ibm websphere_application_server 6.0.2.12
ibm websphere_application_server 6.0.2.13
ibm websphere_application_server 6.0.2.14
ibm websphere_application_server 6.0.2.15
ibm websphere_application_server 6.0.2.16
ibm websphere_application_server 6.0.2.17
ibm websphere_application_server 6.0.2.18
ibm websphere_application_server 6.0.2.19
ibm websphere_application_server 6.0.2.20
ibm websphere_application_server 6.0.2.21
ibm websphere_application_server 6.0.2.22
ibm websphere_application_server 6.0.2.23
ibm websphere_application_server 6.0.2.24
ibm websphere_application_server 6.0.2.25
ibm websphere_application_server 6.0.2.28
ibm websphere_application_server 6.0.2.29
ibm websphere_application_server 6.0.2.30
ibm websphere_application_server 6.0.2.31
ibm websphere_application_server 6.0.2.32
ibm websphere_application_server 6.0.2.33
ibm websphere_application_server 6.1
ibm websphere_application_server 6.1.0
ibm websphere_application_server 6.1.0.0
ibm websphere_application_server 6.1.0.1
ibm websphere_application_server 6.1.0.2
ibm websphere_application_server 6.1.0.3
ibm websphere_application_server 6.1.0.4
ibm websphere_application_server 6.1.0.5
ibm websphere_application_server 6.1.0.6
ibm websphere_application_server 6.1.0.7
ibm websphere_application_server 6.1.0.8
ibm websphere_application_server 6.1.0.9
ibm websphere_application_server 6.1.0.10
ibm websphere_application_server 6.1.0.11
ibm websphere_application_server 6.1.0.12
ibm websphere_application_server 6.1.0.13
ibm websphere_application_server 6.1.0.14
ibm websphere_application_server 6.1.0.15
ibm websphere_application_server 6.1.0.16
ibm websphere_application_server 6.1.0.17
ibm websphere_application_server 6.1.0.18
ibm websphere_application_server 6.1.0.19
ibm websphere_application_server 6.1.0.20
ibm websphere_application_server 6.1.0.21
ibm websphere_application_server 6.1.0.22
ibm websphere_application_server 6.1.0.23
ibm websphere_application_server 7.0
ibm websphere_application_server 7.0.0.1
mono_project mono 1.2.1
mono_project mono 1.2.2
mono_project mono 1.2.3
mono_project mono 1.2.4
mono_project mono 1.2.5
mono_project mono 1.2.6
mono_project mono 1.9
mono_project mono 2.0
oracle application_server 10.1.2.3
oracle application_server 10.1.3.4
oracle application_server 10.1.4.3im
oracle bea_product_suite 8.1
oracle bea_product_suite 9.0
oracle bea_product_suite 9.1
oracle bea_product_suite 9.2
oracle bea_product_suite 10.0
oracle bea_product_suite 10.3
oracle weblogic_server_component 8.1
oracle weblogic_server_component 9.0
oracle weblogic_server_component 9.1
oracle weblogic_server_component 9.2
oracle weblogic_server_component 10.0
oracle weblogic_server_component 10.3


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "01F45BA3-6504-47AF-B757-7B6D3526FBF6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "E3E6D6AF-0D69-4605-B871-6DAE01CF08EF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.0.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "F5EE7744-4584-4AE4-9F27-11EFAA002E77",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.0.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "0DE0C501-4062-49D0-8983-5E92765C7181",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "CE27E903-6D65-4D29-9583-43FB4CB473B1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.1.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "4A754DD5-585B-4E89-9C01-2B47D2F5F6F2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.1.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "D40DEF90-CE7F-46BB-A6FF-50C1797866B8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.1.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "A5AAA544-D3F8-4AE2-BB2D-A64CB86EC988",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.1.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "7C7D4ECD-8787-4F9B-B81C-C0DFD8DD20EC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.1.7:*:*:*:*:*:*:*",
                     matchCriteriaId: "C43D3515-D9F5-4DC8-A030-9F97593495F8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.1.9:*:*:*:*:*:*:*",
                     matchCriteriaId: "A1968803-FF03-477C-81FE-87528FC6DF6A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.1.11:*:*:*:*:*:*:*",
                     matchCriteriaId: "62C1CA3B-E575-4531-A336-8BFC9F5DEC26",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.1.13:*:*:*:*:*:*:*",
                     matchCriteriaId: "6C130982-8C6E-413E-8296-C9C277FCBE6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.1.15:*:*:*:*:*:*:*",
                     matchCriteriaId: "5E1790E4-073A-4666-80CB-4D967928A0BB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.1.17:*:*:*:*:*:*:*",
                     matchCriteriaId: "6239EEAE-5852-4DF7-8627-87139BBB03B4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "714C405D-1E8F-45C1-8A09-5103F0080C76",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:fp17:*:*:*:*:*",
                     matchCriteriaId: "D592217D-3489-40AE-8338-BF5AA5BBA251",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "C7F31FD3-8681-4F07-9644-5CC87D512520",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "C2604E01-E43E-4882-8896-5E646E850286",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "458BAD79-958E-4665-B1F8-0D46E0C57045",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.10:*:*:*:*:*:*:*",
                     matchCriteriaId: "A98E5593-1534-48E2-8CD5-B2D1CACDDAB8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.11:*:*:*:*:*:*:*",
                     matchCriteriaId: "DB4AB6BD-4439-4100-A3CE-4600AED10B65",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.12:*:*:*:*:*:*:*",
                     matchCriteriaId: "FD71D5EA-9AF5-422C-810A-D136A5F132F6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.13:*:*:*:*:*:*:*",
                     matchCriteriaId: "375DF4AF-3C7C-47C3-BBB8-AF2B3827AC13",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.14:*:*:*:*:*:*:*",
                     matchCriteriaId: "2C9D6BDA-39E1-4D15-9D86-E212809998FB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.15:*:*:*:*:*:*:*",
                     matchCriteriaId: "91CC2DA7-BAA6-4061-8D0C-81F002DEF06D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.16:*:*:*:*:*:*:*",
                     matchCriteriaId: "4F2A78FE-8FA6-4532-9E9E-CF6F860EFAE9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.17:*:*:*:*:*:*:*",
                     matchCriteriaId: "59BEDD70-B6DB-448F-A998-3E8774B0DB8C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.18:*:*:*:*:*:*:*",
                     matchCriteriaId: "63099EF9-0512-44CD-946A-9B25144E50D9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.19:*:*:*:*:*:*:*",
                     matchCriteriaId: "F200042C-D45E-4CAD-BF6E-E3DADF4D1D21",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.20:*:*:*:*:*:*:*",
                     matchCriteriaId: "D9132BB1-5E2E-4CA6-9B63-027CF2A7229D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.21:*:*:*:*:*:*:*",
                     matchCriteriaId: "D839EDB9-A44F-4F7F-94EF-1A77371D705C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.22:*:*:*:*:*:*:*",
                     matchCriteriaId: "4421929D-C4B9-43C5-BE61-E68484D3B198",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.23:*:*:*:*:*:*:*",
                     matchCriteriaId: "EB622117-C91F-47D2-9832-B7DB340796E8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.24:*:*:*:*:*:*:*",
                     matchCriteriaId: "0D65E0CC-FA8C-41FD-B256-47DB0C9757FC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.25:*:*:*:*:*:*:*",
                     matchCriteriaId: "6D87691D-0719-4447-B258-5FA2BD10F11A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.28:*:*:*:*:*:*:*",
                     matchCriteriaId: "4D0B1A00-191D-49B2-8841-FB6C48A5D0C2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.29:*:*:*:*:*:*:*",
                     matchCriteriaId: "BF771E28-65AC-4A94-8A51-4EA77BC3D0B3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.30:*:*:*:*:*:*:*",
                     matchCriteriaId: "E5594891-E790-44E7-BC9E-0A413B385E1B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.31:*:*:*:*:*:*:*",
                     matchCriteriaId: "C286007A-361F-47BB-A099-E041D5CF6E48",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.32:*:*:*:*:*:*:*",
                     matchCriteriaId: "CD464F13-942D-40EC-8144-6D23A0AEAA81",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.0.2.33:*:*:*:*:*:*:*",
                     matchCriteriaId: "05BC8C52-DA95-4BF2-AD47-9922741CAAF3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "7B9CDD56-921C-4FAF-87E2-14B91EC1A93D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "95255265-6D69-46D3-9FFA-8EDB1734375C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "2E4191D3-64AB-482C-9DEF-DD04C4C942CE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "5FC6EB31-9707-408B-8BF5-66BD23441A75",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "9B73E052-AF4F-4543-AA03-F5B1FA976EA8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "23171B81-C991-467A-95A4-EDDAC59C37BC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "CBD75308-7F21-4DDF-AD66-C155CF4B721B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "2586C584-3258-414B-AB28-1EBA0DBD0B83",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.6:*:*:*:*:*:*:*",
                     matchCriteriaId: "431C250D-8279-4071-871C-1C7C4DE09B5A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.7:*:*:*:*:*:*:*",
                     matchCriteriaId: "BCA175EA-EDC6-4228-8E28-E9BBC981E60A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.8:*:*:*:*:*:*:*",
                     matchCriteriaId: "FC300B03-7A8F-4E96-B55D-18CC258BBFCF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.9:*:*:*:*:*:*:*",
                     matchCriteriaId: "C6A4EC9D-98C2-40B0-BA40-4838FE8D1FF7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.10:*:*:*:*:*:*:*",
                     matchCriteriaId: "D3A3ADFB-93E0-42E5-B31B-59F22EA4E3EA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.11:*:*:*:*:*:*:*",
                     matchCriteriaId: "7AF5BB33-4E78-4123-8093-EBEE2F2B5598",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.12:*:*:*:*:*:*:*",
                     matchCriteriaId: "E3F4B8EA-9299-42C1-AAFB-831701ED2FA2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.13:*:*:*:*:*:*:*",
                     matchCriteriaId: "A45B6F32-5DFF-4833-9F0F-89576724CF97",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.14:*:*:*:*:*:*:*",
                     matchCriteriaId: "13C8054A-8581-4936-AF94-291AE56EB4DE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.15:*:*:*:*:*:*:*",
                     matchCriteriaId: "13CA9A59-DFE4-4566-8719-E6FA4720F06A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.16:*:*:*:*:*:*:*",
                     matchCriteriaId: "026EBFCD-0BC1-404B-BC14-292F35BE667A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.17:*:*:*:*:*:*:*",
                     matchCriteriaId: "A89DD1BF-4AB0-480D-9856-B1BEA73A4AAD",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.18:*:*:*:*:*:*:*",
                     matchCriteriaId: "B13D74F8-4321-48B3-A33E-FCCFA93013CF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.19:*:*:*:*:*:*:*",
                     matchCriteriaId: "49E119EF-B6A5-4B6C-B199-C64F62CA7CB2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.20:*:*:*:*:*:*:*",
                     matchCriteriaId: "2043B836-3950-46A1-89E4-08985DEA0D33",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.21:*:*:*:*:*:*:*",
                     matchCriteriaId: "C9C8FA3D-9162-4D9B-8250-FAC93ED77A2D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.22:*:*:*:*:*:*:*",
                     matchCriteriaId: "5EE93B7F-3EB5-4BE4-BFAA-4AA30D15A76D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:6.1.0.23:*:*:*:*:*:*:*",
                     matchCriteriaId: "E06DE5D4-D3A5-4783-ACE0-A80808DB09C9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B0905C80-A1BA-49CD-90CA-9270ECC3940C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "B108457A-50DC-4432-9E30-98ADBEBF2389",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mono_project:mono:1.2.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "403E554C-FD1B-42CE-82C2-43CC191905DE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mono_project:mono:1.2.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "78278FE6-26EA-4E89-9423-EABA6C4D8877",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mono_project:mono:1.2.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "15E1695E-FD6E-4602-9BD9-9CFFF20574CA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mono_project:mono:1.2.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "691B3AF1-7F3F-4A7D-9F16-FE6044E33482",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mono_project:mono:1.2.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "E2DE3739-A2ED-47D7-9AE9-442A95ACFC3A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mono_project:mono:1.2.6:*:*:*:*:*:*:*",
                     matchCriteriaId: "DDAB5331-AD2E-483C-93C3-8095BBBA0572",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mono_project:mono:1.9:*:*:*:*:*:*:*",
                     matchCriteriaId: "E3CC03DC-14A6-4C45-9511-7CE8E7F727BB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mono_project:mono:2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C71A1398-8AA5-4AB3-89C8-E2E2B36FA5AC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:application_server:10.1.2.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "96C617ED-3D8C-4B64-A56A-30BDE6E9B8D2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:application_server:10.1.3.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "D41A0A9E-6B5B-4FA9-996B-E589B96C24D7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:application_server:10.1.4.3im:*:*:*:*:*:*:*",
                     matchCriteriaId: "25672ED0-9830-48B3-899A-405B97E2229A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:bea_product_suite:8.1:sp6:*:*:*:*:*:*",
                     matchCriteriaId: "0B8AB045-051A-477E-B2F7-4057826C43F1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:bea_product_suite:9.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "6B5D9ABA-10EE-4EE2-9814-BDFBBE9A6014",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:bea_product_suite:9.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "09215858-8A4F-4595-98DD-39027EC6CC1A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:bea_product_suite:9.2:mp3:*:*:*:*:*:*",
                     matchCriteriaId: "A7390B6A-7944-4509-B499-5B51DB9BF42E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:bea_product_suite:10.0:mp1:*:*:*:*:*:*",
                     matchCriteriaId: "193516AD-8096-4A6E-9C4B-4B9717DD7021",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:bea_product_suite:10.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "2B1C64BD-7C8C-4B28-9EA8-5198B6C71AD1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:weblogic_server_component:8.1:sp6:*:*:*:*:*:*",
                     matchCriteriaId: "B3B986B9-A82B-4087-808E-854EC443AC3C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:weblogic_server_component:9.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "6AF95249-8970-406B-B874-4B9925471C27",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:weblogic_server_component:9.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "DD536DD6-AF76-4075-8B28-322FB65793AE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:weblogic_server_component:9.2:mp3:*:*:*:*:*:*",
                     matchCriteriaId: "9BDA1940-A3F4-4CEC-BDD0-B098B2E27CE5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:weblogic_server_component:10.0:mp1:*:*:*:*:*:*",
                     matchCriteriaId: "3BB8A45D-95E5-4F14-A51A-29B5A6E45F43",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:weblogic_server_component:10.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "1E3D253B-73D7-4916-B5E4-9D553741E98C",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.",
      },
      {
         lang: "es",
         value: "El diseño de la recomendación de W3C XML Signature Syntax and Processing (XMLDsig), tal y como es implementado en productos que incluyen (1) el componente Oracle Security Developer Tools de Application Server de Oracle en versiones 10.1.2.3, 10.1.3.4 y 10.1.4.3IM; (2) el componente WebLogic Server de Product Suite de BEA en las versiones 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0 y 8.1 SP6; (3) Mono anterior a versión 2.4.2.2; (4) XML Security Library anterior a versión 1.2.12; (5) WebSphere Application Server de IBM versiones 6.0 hasta 6.0.2.33, versiones 6.1 hasta 6.1.0.23 y versiones 7.0 hasta 7.0.0.1; (6) JDK y JRE de Sun Update 14 y versiones anteriores; (7) .NET Framework de Microsoft versiones 3.0 hasta 3.0 SP2, versiones 3.5 y 4.0; y otros productos utilizan un parámetro que define una longitud de truncamiento HMAC (HMACOutputLength) pero no requiere un mínimo para esta longitud, lo que permite a los atacantes suplantar firmas basadas en HMAC y omitir la autenticación mediante la especificación de una longitud de truncamiento con un pequeño número de bits.",
      },
   ],
   id: "CVE-2009-0217",
   lastModified: "2024-11-21T00:59:22.190",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 5,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2009-07-14T23:30:00.187",
   references: [
      {
         source: "cret@cert.org",
         url: "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161",
      },
      {
         source: "cret@cert.org",
         url: "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7",
      },
      {
         source: "cret@cert.org",
         url: "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7",
      },
      {
         source: "cret@cert.org",
         url: "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html",
      },
      {
         source: "cret@cert.org",
         url: "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html",
      },
      {
         source: "cret@cert.org",
         url: "http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html",
      },
      {
         source: "cret@cert.org",
         url: "http://marc.info/?l=bugtraq&m=125787273209737&w=2",
      },
      {
         source: "cret@cert.org",
         url: "http://marc.info/?l=bugtraq&m=125787273209737&w=2",
      },
      {
         source: "cret@cert.org",
         url: "http://osvdb.org/55895",
      },
      {
         source: "cret@cert.org",
         url: "http://osvdb.org/55907",
      },
      {
         source: "cret@cert.org",
         url: "http://secunia.com/advisories/34461",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/35776",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/35852",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/35853",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/35854",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/35855",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/35858",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/36162",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/36176",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/36180",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/36494",
      },
      {
         source: "cret@cert.org",
         url: "http://secunia.com/advisories/37300",
      },
      {
         source: "cret@cert.org",
         url: "http://secunia.com/advisories/37671",
      },
      {
         source: "cret@cert.org",
         url: "http://secunia.com/advisories/37841",
      },
      {
         source: "cret@cert.org",
         url: "http://secunia.com/advisories/38567",
      },
      {
         source: "cret@cert.org",
         url: "http://secunia.com/advisories/38568",
      },
      {
         source: "cret@cert.org",
         url: "http://secunia.com/advisories/38695",
      },
      {
         source: "cret@cert.org",
         url: "http://secunia.com/advisories/38921",
      },
      {
         source: "cret@cert.org",
         url: "http://secunia.com/advisories/41818",
      },
      {
         source: "cret@cert.org",
         url: "http://secunia.com/advisories/60799",
      },
      {
         source: "cret@cert.org",
         url: "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
      },
      {
         source: "cret@cert.org",
         url: "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1",
      },
      {
         source: "cret@cert.org",
         url: "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1",
      },
      {
         source: "cret@cert.org",
         url: "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1",
      },
      {
         source: "cret@cert.org",
         url: "http://svn.apache.org/viewvc?revision=794013&view=revision",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023545&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023723&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925",
      },
      {
         source: "cret@cert.org",
         url: "http://www.aleksey.com/xmlsec/",
      },
      {
         source: "cret@cert.org",
         url: "http://www.debian.org/security/2010/dsa-1995",
      },
      {
         source: "cret@cert.org",
         url: "http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml",
      },
      {
         source: "cret@cert.org",
         tags: [
            "US Government Resource",
         ],
         url: "http://www.kb.cert.org/vuls/id/466161",
      },
      {
         source: "cret@cert.org",
         url: "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ",
      },
      {
         source: "cret@cert.org",
         url: "http://www.kb.cert.org/vuls/id/WDON-7TY529",
      },
      {
         source: "cret@cert.org",
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.mono-project.com/Vulnerabilities",
      },
      {
         source: "cret@cert.org",
         url: "http://www.openoffice.org/security/cves/CVE-2009-0217.html",
      },
      {
         source: "cret@cert.org",
         url: "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html",
      },
      {
         source: "cret@cert.org",
         url: "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
      },
      {
         source: "cret@cert.org",
         url: "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
      },
      {
         source: "cret@cert.org",
         url: "http://www.redhat.com/support/errata/RHSA-2009-1694.html",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Patch",
         ],
         url: "http://www.securityfocus.com/bid/35671",
      },
      {
         source: "cret@cert.org",
         url: "http://www.securitytracker.com/id?1022561",
      },
      {
         source: "cret@cert.org",
         url: "http://www.securitytracker.com/id?1022567",
      },
      {
         source: "cret@cert.org",
         url: "http://www.securitytracker.com/id?1022661",
      },
      {
         source: "cret@cert.org",
         url: "http://www.ubuntu.com/usn/USN-903-1",
      },
      {
         source: "cret@cert.org",
         tags: [
            "US Government Resource",
         ],
         url: "http://www.us-cert.gov/cas/techalerts/TA09-294A.html",
      },
      {
         source: "cret@cert.org",
         tags: [
            "US Government Resource",
         ],
         url: "http://www.us-cert.gov/cas/techalerts/TA10-159B.html",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2009/1900",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2009/1908",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2009/1909",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2009/1911",
      },
      {
         source: "cret@cert.org",
         url: "http://www.vupen.com/english/advisories/2009/2543",
      },
      {
         source: "cret@cert.org",
         url: "http://www.vupen.com/english/advisories/2009/3122",
      },
      {
         source: "cret@cert.org",
         url: "http://www.vupen.com/english/advisories/2010/0366",
      },
      {
         source: "cret@cert.org",
         url: "http://www.vupen.com/english/advisories/2010/0635",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html",
      },
      {
         source: "cret@cert.org",
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=511915",
      },
      {
         source: "cret@cert.org",
         url: "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041",
      },
      {
         source: "cret@cert.org",
         url: "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526",
      },
      {
         source: "cret@cert.org",
         url: "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527",
      },
      {
         source: "cret@cert.org",
         url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186",
      },
      {
         source: "cret@cert.org",
         url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158",
      },
      {
         source: "cret@cert.org",
         url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717",
      },
      {
         source: "cret@cert.org",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1200.html",
      },
      {
         source: "cret@cert.org",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1201.html",
      },
      {
         source: "cret@cert.org",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1428.html",
      },
      {
         source: "cret@cert.org",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1636.html",
      },
      {
         source: "cret@cert.org",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1637.html",
      },
      {
         source: "cret@cert.org",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1649.html",
      },
      {
         source: "cret@cert.org",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1650.html",
      },
      {
         source: "cret@cert.org",
         url: "https://usn.ubuntu.com/826-1/",
      },
      {
         source: "cret@cert.org",
         url: "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html",
      },
      {
         source: "cret@cert.org",
         url: "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html",
      },
      {
         source: "cret@cert.org",
         url: "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html",
      },
      {
         source: "cret@cert.org",
         url: "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://marc.info/?l=bugtraq&m=125787273209737&w=2",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://marc.info/?l=bugtraq&m=125787273209737&w=2",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://osvdb.org/55895",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://osvdb.org/55907",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/34461",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/35776",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/35852",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/35853",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/35854",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/35855",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/35858",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/36162",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/36176",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/36180",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/36494",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/37300",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/37671",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/37841",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/38567",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/38568",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/38695",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/38921",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/41818",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/60799",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://svn.apache.org/viewvc?revision=794013&view=revision",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023545&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023723&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.aleksey.com/xmlsec/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.debian.org/security/2010/dsa-1995",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "US Government Resource",
         ],
         url: "http://www.kb.cert.org/vuls/id/466161",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.kb.cert.org/vuls/id/WDON-7TY529",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.mono-project.com/Vulnerabilities",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openoffice.org/security/cves/CVE-2009-0217.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.redhat.com/support/errata/RHSA-2009-1694.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "http://www.securityfocus.com/bid/35671",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securitytracker.com/id?1022561",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securitytracker.com/id?1022567",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securitytracker.com/id?1022661",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.ubuntu.com/usn/USN-903-1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "US Government Resource",
         ],
         url: "http://www.us-cert.gov/cas/techalerts/TA09-294A.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "US Government Resource",
         ],
         url: "http://www.us-cert.gov/cas/techalerts/TA10-159B.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2009/1900",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2009/1908",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2009/1909",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2009/1911",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.vupen.com/english/advisories/2009/2543",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.vupen.com/english/advisories/2009/3122",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.vupen.com/english/advisories/2010/0366",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.vupen.com/english/advisories/2010/0635",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=511915",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1200.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1201.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1428.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1636.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1637.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1649.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://rhn.redhat.com/errata/RHSA-2009-1650.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://usn.ubuntu.com/826-1/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html",
      },
   ],
   sourceIdentifier: "cret@cert.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-Other",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.