Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/santuario-java

              trunk @ 83ea8fa
            

Fixes

CVEs

HIGH

Peak severity

21.4%

Coverage

Highlights

XML External Entity: 6 prior fixes. Scrutinize any change in this area.

XML: most-fixed (2 issues). Treat as high-risk during review.

13 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): XML utility methods and parsing entry points are frequently targeted for XXE via lax DTD, external stylesheet, and external schema resolution configurations during signature processing.

Signature Verification Bypass: Improper element navigation, child element sibling matching, and unsafe parsing fallbacks allow adversaries to bypass cryptographic signature validation or spoof IDs.

Signature Wrapping: Lax structural verification of the ds:Signature element's children allows Signature Wrapping (XSW) attacks, altering the document context without breaking the signature.