CVE-2021-40690

Name of the Vulnerable Software and Affected Versions Apache Santuario - XML Security for Java versions prior to 2.2.3 and 2.1.7

Description The issue is related to the secureValidation property not being passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

Recommendations For Apache Santuario - XML Security for Java versions prior to 2.2.3, upgrade to version 2.2.3 or later. For Apache Santuario - XML Security for Java versions prior to 2.1.7, upgrade to version 2.1.7 or later. As a temporary workaround, consider restricting access to the RetrievalMethod element to minimize the risk of exploitation. Avoid using the secureValidation property in the affected KeyInfo creation until the issue is resolved.