DEBIAN-CVE-2023-44483

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2023-44483
Published: 20 Oct 2023, 10:15
Last modified:16 May 2026, 14:02

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.5 MEDIUM
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Oct 2023, 10:15
Published
Vulnerability first disclosed
16 May 2026, 14:02
Last Modified
Vulnerability information updated

Description

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Systems

  • debian•libxml-security-java

    all | all | all | all | < 2.1.7-3+deb12u1 | < 2.1.8-1.1~deb13u1 | < 2.1.8-1.1

References (1)