{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Oracle WebLogic Server 8.1 \u00e0 8.1 SP6 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Enterprise Manager Grid Control 10g Release 4, version 10.2.0.4 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle E-Business Suite Release 12, version 12.0.6 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle WebLogic Server 10.3, 10.0MP1 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle E-Business Suite Release 11i, version 11.5.10.2 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle WebLogic Server 9.0 GA, 9.1 GA, 9.2 \u00e0 9.2 MP3 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Siebel Highly Interactive Client versions 7.5.3, 7.7.2, 7.8, 8.0, 8.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Database 11g, versions 11.1.0.6, 11.1.0.7 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle E-Business Suite Release 12, version 12.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Database 10g, version 10.1.0.5 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle JRockit R27.6.3 et les versions pr\u00e9c\u00e9dentes (JDK/JRE 6, 5, 1.4.2).",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "PeopleSoft Enterprise HRMS versions 8.9 et 9.0 ;",
      "product": {
        "name": "PeopleSoft",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Identity Management 10g, versions 10.1.4.0.1, 10.1.4.2.0, 10.1.4.3.0 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Application Server 10g Release 3 (10.1.3), versions 10.1.3.3.0, 10.1.3.4.0 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Application Server 10g Release 2 (10.1.2), version 10.1.2.3.0 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Enterprise Manager Database Control 11, versions 11.1.0.6, 11.1.0.7 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Database 10g Release 2, versions 10.2.0.3, 10.2.0.4 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "PeopleSoft Enterprise PeopleTools version 8.49 ;",
      "product": {
        "name": "PeopleSoft",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Database 9i Release 2, versions 9.2.0.8, 9.2.0.8DV ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Complex Event Processing 10.3 et WebLogic Event Server 2.0 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle WebLogic Server 7.0 \u00e0 7.0 SP7 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUn grand nombre de vuln\u00e9rabilit\u00e9s a \u00e9t\u00e9 d\u00e9couvert dans les produits\nOracle. L\u0027exploitation de ces vuln\u00e9rabilit\u00e9s permet de r\u00e9aliser diverses\nactions malveillantes, dont l\u0027ex\u00e9cution de code arbitraire \u00e0 distance\npour certaines.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2009-1019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1019"
    },
    {
      "name": "CVE-2009-1978",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1978"
    },
    {
      "name": "CVE-2009-1969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1969"
    },
    {
      "name": "CVE-2009-1976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1976"
    },
    {
      "name": "CVE-2009-1987",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1987"
    },
    {
      "name": "CVE-2009-1966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1966"
    },
    {
      "name": "CVE-2009-1970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1970"
    },
    {
      "name": "CVE-2009-1988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1988"
    },
    {
      "name": "CVE-2009-1968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1968"
    },
    {
      "name": "CVE-2009-1974",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1974"
    },
    {
      "name": "CVE-2009-1983",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1983"
    },
    {
      "name": "CVE-2009-1094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1094"
    },
    {
      "name": "CVE-2009-1020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1020"
    },
    {
      "name": "CVE-2009-1015",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1015"
    },
    {
      "name": "CVE-2009-1975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1975"
    },
    {
      "name": "CVE-2009-1973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1973"
    },
    {
      "name": "CVE-2009-1977",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1977"
    },
    {
      "name": "CVE-2009-0217",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0217"
    },
    {
      "name": "CVE-2009-1967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1967"
    },
    {
      "name": "CVE-2009-1982",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1982"
    },
    {
      "name": "CVE-2009-0987",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0987"
    },
    {
      "name": "CVE-2009-1986",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1986"
    },
    {
      "name": "CVE-2009-1963",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1963"
    },
    {
      "name": "CVE-2009-1021",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1021"
    },
    {
      "name": "CVE-2009-1984",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1984"
    },
    {
      "name": "CVE-2009-1989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1989"
    },
    {
      "name": "CVE-2009-1981",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1981"
    },
    {
      "name": "CVE-2009-1980",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1980"
    },
    {
      "name": "CVE-2009-1523",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1523"
    }
  ],
  "initial_release_date": "2009-07-15T00:00:00",
  "last_revision_date": "2009-07-15T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Oracle de Juillet 2009 :",
      "url": "http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2009.html"
    }
  ],
  "reference": "CERTA-2009-AVI-279",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-07-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nOracle. L\u0027exploitation de ces vuln\u00e9rabilit\u00e9s permet de r\u00e9aliser diverses\nactions malveillantes, dont l\u0027ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans des produits Oracle",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Oracle de juillet 2009",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Oracle WebLogic Portal, versions 8.1 \u00e0 8.1 SP6, 9.2 \u00e0 9.2 MP3, 10.0 \u00e0 10.0MP1, 10.2 \u00e0 10.2MP1 et 10.3 \u00e0 10.3.1 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "AutoVue version 19.3 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Application Server 10g Release 3 (10.1.3), versions 10.1.3.4.0 et 10.1.3.5.0 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "JDEdward Tools version 8.98 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Database 9i Release 2, versions 9.2.0.8 et 9.2.0.8DV ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "PeopleSoft Enterprise HCM (TAM) versions 8.9 et 9.0 ;",
      "product": {
        "name": "PeopleSoft",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle WebLogic Server versions 9.0 GA, 9.1 GA et 9.2 \u00e0 9.2 MP3 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Database 11g, version 11.1.0.7 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Database 10g, version 10.1.0.5 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle WebLogic Server versions 10.0 jusqu\u0027\u00e0 MP1 et version 10.3 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Business Intelligence Enterprise Edition, versions 10.1.3.4.0 et 10.1.3.4.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Database 10g Release 2, versions 10.2.0.3 et 10.2.0.4 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Communications Order et Service Management, versions 2.8.0, 6.2.0, 6.3.0 et 6.3.1.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Application Server 10g Release 2 (10.1.2), version 10.1.2.3.0 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle WebLogic Server versions 8.1 \u00e0 8.1 SP5 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle E-Business Suite Release 11i version 11.5.10.2 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "PeopleSoft PeopleTools \u0026 Enterprise Portal version 8.49 ;",
      "product": {
        "name": "PeopleSoft",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle E-Business Suite Release 12 versions 12.0.6 et 12.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle JRockit R27.6.4 et versions ant\u00e9rieures (JDK/JRE 6, 5, 1.4.2) ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Agile Engineering Data Management (EDM) version 6.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle WebLogic Server versions 7.0 \u00e0 7.0 SP6 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les diff\u00e9rents\nproduits Oracle. Ces vuln\u00e9rabilit\u00e9s touchent les produits des branches\nde gestion de base de donn\u00e9es, de serveurs applicatifs, de E-business,\nde PeopleSoft et de BEA.\n\nL\u0027exploitation de ces nombreuses vuln\u00e9rabilit\u00e9s permet des actions\nmalveillantes diverses, dont l\u0027ex\u00e9cution de code arbitraire \u00e0 distance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2009-3399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3399"
    },
    {
      "name": "CVE-2009-3400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3400"
    },
    {
      "name": "CVE-2009-2002",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2002"
    },
    {
      "name": "CVE-2009-3406",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3406"
    },
    {
      "name": "CVE-2009-1972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1972"
    },
    {
      "name": "CVE-2009-1993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1993"
    },
    {
      "name": "CVE-2009-3403",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3403"
    },
    {
      "name": "CVE-2009-3404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3404"
    },
    {
      "name": "CVE-2009-3392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3392"
    },
    {
      "name": "CVE-2009-1979",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1979"
    },
    {
      "name": "CVE-2009-1995",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1995"
    },
    {
      "name": "CVE-2009-3402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3402"
    },
    {
      "name": "CVE-2009-1998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1998"
    },
    {
      "name": "CVE-2009-1964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1964"
    },
    {
      "name": "CVE-2009-1990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1990"
    },
    {
      "name": "CVE-2009-1992",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1992"
    },
    {
      "name": "CVE-2009-3396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3396"
    },
    {
      "name": "CVE-2009-3395",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3395"
    },
    {
      "name": "CVE-2009-3408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3408"
    },
    {
      "name": "CVE-2009-2625",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2625"
    },
    {
      "name": "CVE-2009-2000",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2000"
    },
    {
      "name": "CVE-2009-3397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3397"
    },
    {
      "name": "CVE-2009-1965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1965"
    },
    {
      "name": "CVE-2009-2001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2001"
    },
    {
      "name": "CVE-2009-1018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1018"
    },
    {
      "name": "CVE-2009-1991",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1991"
    },
    {
      "name": "CVE-2009-0217",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0217"
    },
    {
      "name": "CVE-2009-1971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1971"
    },
    {
      "name": "CVE-2009-1985",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1985"
    },
    {
      "name": "CVE-2009-1997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1997"
    },
    {
      "name": "CVE-2009-3405",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3405"
    },
    {
      "name": "CVE-2009-1007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1007"
    },
    {
      "name": "CVE-2009-3409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3409"
    },
    {
      "name": "CVE-2009-3401",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3401"
    },
    {
      "name": "CVE-2009-1999",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1999"
    },
    {
      "name": "CVE-2009-1994",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1994"
    },
    {
      "name": "CVE-2009-3407",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3407"
    },
    {
      "name": "CVE-2009-3393",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3393"
    }
  ],
  "initial_release_date": "2009-10-21T00:00:00",
  "last_revision_date": "2009-10-21T00:00:00",
  "links": [],
  "reference": "CERTA-2009-AVI-452",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-10-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s affectent diff\u00e9rents produits Oracle.\nL\u0027exploitation de ces vuln\u00e9rabilit\u00e9s permet de nombreuses actions\nmalveillantes, dont l\u0027ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s des produits Oracle",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Oracle du mois d\u0027octobre 2009",
      "url": "http://www.oracle.com/technologiy/deploy/security/critical-patch-updates/cpuoct2009.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eOpenOffice.org versions ant\u00e9rieures \u00e0  3.2.\u003c/p\u003e",
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le navigateur\nOpenOffice.org. Leurs exploitations permettent notamment \u00e0 une personne\nmalintentionn\u00e9e d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-4339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4339"
    },
    {
      "name": "CVE-2009-3301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3301"
    },
    {
      "name": "CVE-2009-2949",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2949"
    },
    {
      "name": "CVE-2009-2950",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2950"
    },
    {
      "name": "CVE-2009-3302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3302"
    },
    {
      "name": "CVE-2009-0217",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0217"
    },
    {
      "name": "CVE-2009-2493",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2493"
    }
  ],
  "initial_release_date": "2010-02-15T00:00:00",
  "last_revision_date": "2010-02-15T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian dsa-1995-1 du 12 f\u00e9vrier 2010 :",
      "url": "http://www.debian.org/security/2010/dsa-1995"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 OpenOffice CVE-2006-4339 :",
      "url": "http://www.openoffice.org/security/cves/CVE-2006-4339.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 OpenOffice CVE-2009-0217 :",
      "url": "http://www.openoffice.org/security/cves/CVE-2009-0217.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 OpenOffice CVE-2009-3301 :",
      "url": "http://www.openoffice.org/security/cves/CVE-2009-3301.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 OpenOffice CVE-2009-3302 :",
      "url": "http://www.openoffice.org/security/cves/CVE-2009-3302.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Redhat RHSA-2010-0101-1 du 12 f\u00e9vrier    2010 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2010-0101.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 OpenOffice CVE-2009-2493 :",
      "url": "http://www.openoffice.org/security/cves/CVE-2009-2493.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 OpenOffice CVE-2009-2949 :",
      "url": "http://www.openoffice.org/security/cves/CVE-2009-2949.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 OpenOffice CVE-2009-2950 :",
      "url": "http://www.openoffice.org/security/cves/CVE-2009-2950.html"
    }
  ],
  "reference": "CERTA-2010-AVI-080",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-02-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s dans OpenOffice.org permettent, entre\nautres, l\u0027ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans OpenOffice",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenOffice du 12 f\u00e9vrier 2010",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eMicrosoft .NET\u0026nbsp;:  \u003cUL\u003e    \u003cLI\u003e1.x sans et avec Service Pack;\u003c/LI\u003e    \u003cLI\u003e2.x sans et avec Service Pack;\u003c/LI\u003e    \u003cLI\u003e3.5 sauf la version sans Service Pack sur Vista SP2 et    Windows Server 2008 SP2 ;\u003c/LI\u003e    \u003cLI\u003e3.5.1.\u003c/LI\u003e  \u003c/UL\u003e\u003c/p\u003e",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 dans la signature des documents XML permet \u00e0 un\nutilisateur malveillant de modifier un document sign\u00e9 sans que cette\nmanipulation soit detect\u00e9e.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2009-0217",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0217"
    }
  ],
  "initial_release_date": "2010-06-09T00:00:00",
  "last_revision_date": "2010-06-09T00:00:00",
  "links": [],
  "reference": "CERTA-2010-AVI-253",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-06-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans Microsoft .NET permet \u00e0 un utilisateur\nmalveillant de modifier des donn\u00e9es sans que cela soit detect\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Microsoft .NET",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS10-041 du 08 juin 2010",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS10-041.mspx"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Oracle Secure Backup version 10301 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Database 9i Release 2, versions 9208, 9208DV ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "PeopleSoft Enterprise PeopleTools, versions 849 et 850 ;",
      "product": {
        "name": "PeopleSoft",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle JRockit versions R2800 et ant\u00e9rieures (JDK/JRE 5 et 6) ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "PeopleSoft Enterprise FSCM, versions 89, 90 et 91 ;",
      "product": {
        "name": "PeopleSoft",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle JRockit versions R2766 et ant\u00e9rieures (JDK/JRE 142, 5 et 6) ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Database 11g Release 2, version 11201 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "PeopleSoft Enterprise HCM, versions 89, 90 et 91 ;",
      "product": {
        "name": "PeopleSoft",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle WebLogic Server 100 jusqu\u0027\u00e0 la version MP2 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle WebLogic Server 70 jusqu\u0027au Service Pack 7 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Sun Product Suite.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle WebLogic Server 90, 91, 92 jusqu\u0027\u00e0 la version MP3 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle WebLogic Server 11gR1 versions 1031, 1032 et 1033 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Business Process Management, versions 573, 605, 1031 et 1032 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle E-Business Suite Release 12, versions 1204, 1205, 1206, 1211 et 1212 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle WebLogic Server 81 jusqu\u0027au Service Pack 6 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "PeopleSoft Enterprise Campus Solutions, version 90 ;",
      "product": {
        "name": "PeopleSoft",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Transportation Manager, Versions: 550507, 550600 et 6003 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Enterprise Manager Grid Control 10g Release 5, version 10205 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle E-Business Suite Release 11i, versions 11510 et 115102 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Application Server, 10gR2, version 101230 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Identity Management 10g, version 101401 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Enterprise Manager Grid Control 10g Release 1, version 10106 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "PeopleSoft Enterprise CRM, versions 90 et 91 ;",
      "product": {
        "name": "PeopleSoft",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle TimesTen In-Memory Database, versions 7060, 112141 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Database 10g Release 2, versions 10203, 10204 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Database 10g, version 10105 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle WebLogic Server 10gR3 version 1030 ;",
      "product": {
        "name": "Weblogic",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "Oracle Database 11g Release 1, version 11107 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s sont pr\u00e9sentes dans les produits Oracle\ncomme Oracle Database ou Oracle WebLogic. Elles permettent, entre\nautres, \u00e0 un utilisateur distant malintentionn\u00e9 de provoquer un d\u00e9ni de\nservice ou d\u0027\u00e9xecuter du code arbitaire.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2010-0906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0906"
    },
    {
      "name": "CVE-2010-0898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0898"
    },
    {
      "name": "CVE-2010-2380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2380"
    },
    {
      "name": "CVE-2010-2382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2382"
    },
    {
      "name": "CVE-2010-0903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0903"
    },
    {
      "name": "CVE-2010-0899",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0899"
    },
    {
      "name": "CVE-2010-2381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2381"
    },
    {
      "name": "CVE-2010-2394",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2394"
    },
    {
      "name": "CVE-2010-2373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2373"
    },
    {
      "name": "CVE-2010-0909",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0909"
    },
    {
      "name": "CVE-2010-0907",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0907"
    },
    {
      "name": "CVE-2010-2392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2392"
    },
    {
      "name": "CVE-2010-2393",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2393"
    },
    {
      "name": "CVE-2010-0914",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0914"
    },
    {
      "name": "CVE-2010-0901",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0901"
    },
    {
      "name": "CVE-2010-0892",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0892"
    },
    {
      "name": "CVE-2010-2386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2386"
    },
    {
      "name": "CVE-2010-0915",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0915"
    },
    {
      "name": "CVE-2010-0873",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0873"
    },
    {
      "name": "CVE-2010-0083",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0083"
    },
    {
      "name": "CVE-2009-3763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3763"
    },
    {
      "name": "CVE-2010-2375",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2375"
    },
    {
      "name": "CVE-2009-3555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3555"
    },
    {
      "name": "CVE-2008-4247",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-4247"
    },
    {
      "name": "CVE-2010-2400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2400"
    },
    {
      "name": "CVE-2010-0849",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0849"
    },
    {
      "name": "CVE-2010-2384",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2384"
    },
    {
      "name": "CVE-2010-2374",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2374"
    },
    {
      "name": "CVE-2010-2402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2402"
    },
    {
      "name": "CVE-2010-0912",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0912"
    },
    {
      "name": "CVE-2010-0913",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0913"
    },
    {
      "name": "CVE-2010-2401",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2401"
    },
    {
      "name": "CVE-2009-3764",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3764"
    },
    {
      "name": "CVE-2010-2376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2376"
    },
    {
      "name": "CVE-2010-0911",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0911"
    },
    {
      "name": "CVE-2010-2372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2372"
    },
    {
      "name": "CVE-2009-0217",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0217"
    },
    {
      "name": "CVE-2010-2398",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2398"
    },
    {
      "name": "CVE-2010-2399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2399"
    },
    {
      "name": "CVE-2010-0081",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0081"
    },
    {
      "name": "CVE-2010-2377",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2377"
    },
    {
      "name": "CVE-2010-0916",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0916"
    },
    {
      "name": "CVE-2010-0835",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0835"
    },
    {
      "name": "CVE-2010-2403",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2403"
    },
    {
      "name": "CVE-2010-2378",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2378"
    },
    {
      "name": "CVE-2010-0900",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0900"
    },
    {
      "name": "CVE-2010-0908",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0908"
    },
    {
      "name": "CVE-2010-2370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2370"
    },
    {
      "name": "CVE-2010-0910",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0910"
    },
    {
      "name": "CVE-2010-0904",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0904"
    },
    {
      "name": "CVE-2010-2383",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2383"
    },
    {
      "name": "CVE-2010-0902",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0902"
    },
    {
      "name": "CVE-2010-2385",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2385"
    },
    {
      "name": "CVE-2009-3762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3762"
    },
    {
      "name": "CVE-2010-0905",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0905"
    },
    {
      "name": "CVE-2010-0836",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0836"
    },
    {
      "name": "CVE-2010-2371",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2371"
    },
    {
      "name": "CVE-2010-2379",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2379"
    },
    {
      "name": "CVE-2010-2397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2397"
    }
  ],
  "initial_release_date": "2010-07-15T00:00:00",
  "last_revision_date": "2010-07-15T00:00:00",
  "links": [],
  "reference": "CERTA-2010-AVI-314",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-07-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans les produits Oracle\npermettent \u00e0 un utilisateur distant de provoquer un d\u00e9ni de service ou\nd\u0027\u00e9xecuter du code arbitraire.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Oracle",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Oracle du 13 juillet 2010",
      "url": "http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2010.html"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "01F45BA3-6504-47AF-B757-7B6D3526FBF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3E6D6AF-0D69-4605-B871-6DAE01CF08EF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5EE7744-4584-4AE4-9F27-11EFAA002E77",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DE0C501-4062-49D0-8983-5E92765C7181",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE27E903-6D65-4D29-9583-43FB4CB473B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A754DD5-585B-4E89-9C01-2B47D2F5F6F2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D40DEF90-CE7F-46BB-A6FF-50C1797866B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5AAA544-D3F8-4AE2-BB2D-A64CB86EC988",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "7C7D4ECD-8787-4F9B-B81C-C0DFD8DD20EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "C43D3515-D9F5-4DC8-A030-9F97593495F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1968803-FF03-477C-81FE-87528FC6DF6A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "62C1CA3B-E575-4531-A336-8BFC9F5DEC26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "6C130982-8C6E-413E-8296-C9C277FCBE6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E1790E4-073A-4666-80CB-4D967928A0BB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "6239EEAE-5852-4DF7-8627-87139BBB03B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "714C405D-1E8F-45C1-8A09-5103F0080C76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:fp17:*:*:*:*:*",
              "matchCriteriaId": "D592217D-3489-40AE-8338-BF5AA5BBA251",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7F31FD3-8681-4F07-9644-5CC87D512520",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2604E01-E43E-4882-8896-5E646E850286",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "458BAD79-958E-4665-B1F8-0D46E0C57045",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A98E5593-1534-48E2-8CD5-B2D1CACDDAB8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB4AB6BD-4439-4100-A3CE-4600AED10B65",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD71D5EA-9AF5-422C-810A-D136A5F132F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "375DF4AF-3C7C-47C3-BBB8-AF2B3827AC13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C9D6BDA-39E1-4D15-9D86-E212809998FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "91CC2DA7-BAA6-4061-8D0C-81F002DEF06D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F2A78FE-8FA6-4532-9E9E-CF6F860EFAE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "59BEDD70-B6DB-448F-A998-3E8774B0DB8C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "63099EF9-0512-44CD-946A-9B25144E50D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "F200042C-D45E-4CAD-BF6E-E3DADF4D1D21",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9132BB1-5E2E-4CA6-9B63-027CF2A7229D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "D839EDB9-A44F-4F7F-94EF-1A77371D705C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "4421929D-C4B9-43C5-BE61-E68484D3B198",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB622117-C91F-47D2-9832-B7DB340796E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.24:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D65E0CC-FA8C-41FD-B256-47DB0C9757FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.25:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D87691D-0719-4447-B258-5FA2BD10F11A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.28:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D0B1A00-191D-49B2-8841-FB6C48A5D0C2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.29:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF771E28-65AC-4A94-8A51-4EA77BC3D0B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5594891-E790-44E7-BC9E-0A413B385E1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "C286007A-361F-47BB-A099-E041D5CF6E48",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.32:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD464F13-942D-40EC-8144-6D23A0AEAA81",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.33:*:*:*:*:*:*:*",
              "matchCriteriaId": "05BC8C52-DA95-4BF2-AD47-9922741CAAF3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B9CDD56-921C-4FAF-87E2-14B91EC1A93D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "95255265-6D69-46D3-9FFA-8EDB1734375C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E4191D3-64AB-482C-9DEF-DD04C4C942CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5FC6EB31-9707-408B-8BF5-66BD23441A75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B73E052-AF4F-4543-AA03-F5B1FA976EA8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "23171B81-C991-467A-95A4-EDDAC59C37BC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "CBD75308-7F21-4DDF-AD66-C155CF4B721B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "2586C584-3258-414B-AB28-1EBA0DBD0B83",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "431C250D-8279-4071-871C-1C7C4DE09B5A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCA175EA-EDC6-4228-8E28-E9BBC981E60A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC300B03-7A8F-4E96-B55D-18CC258BBFCF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6A4EC9D-98C2-40B0-BA40-4838FE8D1FF7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "D3A3ADFB-93E0-42E5-B31B-59F22EA4E3EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "7AF5BB33-4E78-4123-8093-EBEE2F2B5598",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3F4B8EA-9299-42C1-AAFB-831701ED2FA2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "A45B6F32-5DFF-4833-9F0F-89576724CF97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "13C8054A-8581-4936-AF94-291AE56EB4DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "13CA9A59-DFE4-4566-8719-E6FA4720F06A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "026EBFCD-0BC1-404B-BC14-292F35BE667A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "A89DD1BF-4AB0-480D-9856-B1BEA73A4AAD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "B13D74F8-4321-48B3-A33E-FCCFA93013CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "49E119EF-B6A5-4B6C-B199-C64F62CA7CB2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "2043B836-3950-46A1-89E4-08985DEA0D33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9C8FA3D-9162-4D9B-8250-FAC93ED77A2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "5EE93B7F-3EB5-4BE4-BFAA-4AA30D15A76D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "E06DE5D4-D3A5-4783-ACE0-A80808DB09C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0905C80-A1BA-49CD-90CA-9270ECC3940C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B108457A-50DC-4432-9E30-98ADBEBF2389",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mono_project:mono:1.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "403E554C-FD1B-42CE-82C2-43CC191905DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mono_project:mono:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "78278FE6-26EA-4E89-9423-EABA6C4D8877",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mono_project:mono:1.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "15E1695E-FD6E-4602-9BD9-9CFFF20574CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mono_project:mono:1.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "691B3AF1-7F3F-4A7D-9F16-FE6044E33482",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mono_project:mono:1.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2DE3739-A2ED-47D7-9AE9-442A95ACFC3A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mono_project:mono:1.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "DDAB5331-AD2E-483C-93C3-8095BBBA0572",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mono_project:mono:1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3CC03DC-14A6-4C45-9511-7CE8E7F727BB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mono_project:mono:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C71A1398-8AA5-4AB3-89C8-E2E2B36FA5AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:application_server:10.1.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "96C617ED-3D8C-4B64-A56A-30BDE6E9B8D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:application_server:10.1.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "D41A0A9E-6B5B-4FA9-996B-E589B96C24D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:application_server:10.1.4.3im:*:*:*:*:*:*:*",
              "matchCriteriaId": "25672ED0-9830-48B3-899A-405B97E2229A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:8.1:sp6:*:*:*:*:*:*",
              "matchCriteriaId": "0B8AB045-051A-477E-B2F7-4057826C43F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B5D9ABA-10EE-4EE2-9814-BDFBBE9A6014",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "09215858-8A4F-4595-98DD-39027EC6CC1A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:9.2:mp3:*:*:*:*:*:*",
              "matchCriteriaId": "A7390B6A-7944-4509-B499-5B51DB9BF42E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:10.0:mp1:*:*:*:*:*:*",
              "matchCriteriaId": "193516AD-8096-4A6E-9C4B-4B9717DD7021",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:10.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B1C64BD-7C8C-4B28-9EA8-5198B6C71AD1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:weblogic_server_component:8.1:sp6:*:*:*:*:*:*",
              "matchCriteriaId": "B3B986B9-A82B-4087-808E-854EC443AC3C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:weblogic_server_component:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AF95249-8970-406B-B874-4B9925471C27",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:weblogic_server_component:9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD536DD6-AF76-4075-8B28-322FB65793AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:weblogic_server_component:9.2:mp3:*:*:*:*:*:*",
              "matchCriteriaId": "9BDA1940-A3F4-4CEC-BDD0-B098B2E27CE5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:weblogic_server_component:10.0:mp1:*:*:*:*:*:*",
              "matchCriteriaId": "3BB8A45D-95E5-4F14-A51A-29B5A6E45F43",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:weblogic_server_component:10.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E3D253B-73D7-4916-B5E4-9D553741E98C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits."
    },
    {
      "lang": "es",
      "value": "El dise\u00f1o de la recomendaci\u00f3n de W3C XML Signature Syntax and Processing (XMLDsig), tal y como es implementado en productos que incluyen (1) el componente Oracle Security Developer Tools de Application Server de Oracle en versiones 10.1.2.3, 10.1.3.4 y 10.1.4.3IM; (2) el componente WebLogic Server de Product Suite de BEA en las versiones 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0 y 8.1 SP6; (3) Mono anterior a versi\u00f3n 2.4.2.2; (4) XML Security Library anterior a versi\u00f3n 1.2.12; (5) WebSphere Application Server de IBM versiones 6.0 hasta 6.0.2.33, versiones 6.1 hasta 6.1.0.23 y versiones 7.0 hasta 7.0.0.1; (6) JDK y JRE de Sun Update 14 y versiones anteriores; (7) .NET Framework de Microsoft versiones 3.0 hasta 3.0 SP2, versiones 3.5 y 4.0; y otros productos utilizan un par\u00e1metro que define una longitud de truncamiento HMAC (HMACOutputLength) pero no requiere un m\u00ednimo para esta longitud, lo que permite a los atacantes suplantar firmas basadas en HMAC y omitir la autenticaci\u00f3n mediante la especificaci\u00f3n de una longitud de truncamiento con un peque\u00f1o n\u00famero de bits."
    }
  ],
  "id": "CVE-2009-0217",
  "lastModified": "2026-04-23T00:35:47.467",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-07-14T23:30:00.187",
  "references": [
    {
      "source": "cret@cert.org",
      "url": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161"
    },
    {
      "source": "cret@cert.org",
      "url": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
    },
    {
      "source": "cret@cert.org",
      "url": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
    },
    {
      "source": "cret@cert.org",
      "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
    },
    {
      "source": "cret@cert.org",
      "url": "http://osvdb.org/55895"
    },
    {
      "source": "cret@cert.org",
      "url": "http://osvdb.org/55907"
    },
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/34461"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35776"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35852"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35853"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35854"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35855"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35858"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36162"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36176"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36180"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36494"
    },
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/37300"
    },
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/37671"
    },
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/37841"
    },
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/38567"
    },
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/38568"
    },
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/38695"
    },
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/38921"
    },
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/41818"
    },
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/60799"
    },
    {
      "source": "cret@cert.org",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
    },
    {
      "source": "cret@cert.org",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1"
    },
    {
      "source": "cret@cert.org",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1"
    },
    {
      "source": "cret@cert.org",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1"
    },
    {
      "source": "cret@cert.org",
      "url": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023545\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023723\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.aleksey.com/xmlsec/"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.debian.org/security/2010/dsa-1995"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/466161"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.kb.cert.org/vuls/id/WDON-7TY529"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.mono-project.com/Vulnerabilities"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.openoffice.org/security/cves/CVE-2009-0217.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2009-1694.html"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/35671"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.securitytracker.com/id?1022561"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.securitytracker.com/id?1022567"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.securitytracker.com/id?1022661"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.ubuntu.com/usn/USN-903-1"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1900"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1908"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1909"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1911"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.vupen.com/english/advisories/2009/2543"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.vupen.com/english/advisories/2009/3122"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.vupen.com/english/advisories/2010/0366"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.vupen.com/english/advisories/2010/0635"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html"
    },
    {
      "source": "cret@cert.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915"
    },
    {
      "source": "cret@cert.org",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041"
    },
    {
      "source": "cret@cert.org",
      "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526"
    },
    {
      "source": "cret@cert.org",
      "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527"
    },
    {
      "source": "cret@cert.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186"
    },
    {
      "source": "cret@cert.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158"
    },
    {
      "source": "cret@cert.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717"
    },
    {
      "source": "cret@cert.org",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
    },
    {
      "source": "cret@cert.org",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
    },
    {
      "source": "cret@cert.org",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1428.html"
    },
    {
      "source": "cret@cert.org",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html"
    },
    {
      "source": "cret@cert.org",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html"
    },
    {
      "source": "cret@cert.org",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html"
    },
    {
      "source": "cret@cert.org",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html"
    },
    {
      "source": "cret@cert.org",
      "url": "https://usn.ubuntu.com/826-1/"
    },
    {
      "source": "cret@cert.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
    },
    {
      "source": "cret@cert.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
    },
    {
      "source": "cret@cert.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html"
    },
    {
      "source": "cret@cert.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/55895"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/55907"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/34461"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35776"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35852"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35853"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35854"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35855"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35858"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36162"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36176"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36180"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36494"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/37300"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/37671"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/37841"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/38567"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/38568"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/38695"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/38921"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/41818"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/60799"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023545\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023723\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.aleksey.com/xmlsec/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2010/dsa-1995"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/466161"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.kb.cert.org/vuls/id/WDON-7TY529"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.mono-project.com/Vulnerabilities"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openoffice.org/security/cves/CVE-2009-0217.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2009-1694.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/35671"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1022561"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1022567"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1022661"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-903-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1900"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1908"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1909"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1911"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2009/2543"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2009/3122"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2010/0366"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2010/0635"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1428.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://usn.ubuntu.com/826-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.santuario:xmlsec"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2009-0217"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-08T14:55:27Z",
    "nvd_published_at": "2009-07-14T23:30:00Z",
    "severity": "MODERATE"
  },
  "details": "The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in multiple products.\n\nThe Apache XML Security (Java) is affected by the vulnerability published in US-Cert VU #466161. See: http://www.kb.cert.org/vuls/id/466161 for more information. This bug can allow an attacker to bypass authentication by inserting/modifying a small HMAC truncation length parameter in the XML Signature HMAC based SignatureMethod algorithms.\n\nAn inexhaustive list of additional affected products includes:  \n1. the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; \n2. the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; \n3. Mono before 2.4.2.2; \n4. XML Security Library before 1.2.12; \n5. IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; \n6. Sun JDK and JRE Update 14 and earlier; \n7. Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.",
  "id": "GHSA-8hfm-837h-hjg5",
  "modified": "2022-11-08T14:55:27Z",
  "published": "2022-05-02T03:13:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0217"
    },
    {
      "type": "WEB",
      "url": "https://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html"
    },
    {
      "type": "WEB",
      "url": "https://www.w3.org/2008/06/xmldsigcore-errata.html#e03"
    },
    {
      "type": "WEB",
      "url": "https://www.us-cert.gov/cas/techalerts/TA09-294A.html"
    },
    {
      "type": "WEB",
      "url": "https://www.ubuntu.com/usn/USN-903-1"
    },
    {
      "type": "WEB",
      "url": "https://www.redhat.com/support/errata/RHSA-2009-1694.html"
    },
    {
      "type": "WEB",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html"
    },
    {
      "type": "WEB",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html"
    },
    {
      "type": "WEB",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
    },
    {
      "type": "WEB",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
    },
    {
      "type": "WEB",
      "url": "https://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/WDON-7TY529"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/MAPG-7TSKXQ"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/466161"
    },
    {
      "type": "WEB",
      "url": "https://www.gentoo.org/security/en/glsa/glsa-201408-19.xml"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2010/dsa-1995"
    },
    {
      "type": "WEB",
      "url": "https://svn.apache.org/viewvc?revision=794013\u0026view=revision"
    },
    {
      "type": "WEB",
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1428.html"
    },
    {
      "type": "WEB",
      "url": "https://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/Archive/xmlsec/-/commit/34b349675af9f72eb822837a8772cc1ead7115c7"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation"
}

{
  "GSD": {
    "alias": "CVE-2009-0217",
    "description": "The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.",
    "id": "GSD-2009-0217",
    "references": [
      "https://www.suse.com/security/cve/CVE-2009-0217.html",
      "https://www.debian.org/security/2010/dsa-1995",
      "https://www.debian.org/security/2009/dsa-1849",
      "https://access.redhat.com/errata/RHSA-2010:0043",
      "https://access.redhat.com/errata/RHSA-2009:1694",
      "https://access.redhat.com/errata/RHSA-2009:1650",
      "https://access.redhat.com/errata/RHSA-2009:1649",
      "https://access.redhat.com/errata/RHSA-2009:1637",
      "https://access.redhat.com/errata/RHSA-2009:1636",
      "https://access.redhat.com/errata/RHSA-2009:1428",
      "https://access.redhat.com/errata/RHSA-2009:1201",
      "https://access.redhat.com/errata/RHSA-2009:1200",
      "https://linux.oracle.com/cve/CVE-2009-0217.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2009-0217"
      ],
      "details": "The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.",
      "id": "GSD-2009-0217",
      "modified": "2023-12-13T01:19:44.491810Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cert@cert.org",
        "ID": "CVE-2009-0217",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "RHSA-2009:1428",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1428.html"
          },
          {
            "name": "ADV-2009-3122",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2009/3122"
          },
          {
            "name": "http://www.openoffice.org/security/cves/CVE-2009-0217.html",
            "refsource": "CONFIRM",
            "url": "http://www.openoffice.org/security/cves/CVE-2009-0217.html"
          },
          {
            "name": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526",
            "refsource": "CONFIRM",
            "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526"
          },
          {
            "name": "60799",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/60799"
          },
          {
            "name": "GLSA-201408-19",
            "refsource": "GENTOO",
            "url": "http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml"
          },
          {
            "name": "PK80596",
            "refsource": "AIXAPAR",
            "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023545\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
          },
          {
            "name": "RHSA-2009:1200",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
          },
          {
            "name": "35776",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/35776"
          },
          {
            "name": "36162",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/36162"
          },
          {
            "name": "36494",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/36494"
          },
          {
            "name": "ADV-2009-2543",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2009/2543"
          },
          {
            "name": "35858",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/35858"
          },
          {
            "name": "38695",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/38695"
          },
          {
            "name": "269208",
            "refsource": "SUNALERT",
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1"
          },
          {
            "name": "DSA-1995",
            "refsource": "DEBIAN",
            "url": "http://www.debian.org/security/2010/dsa-1995"
          },
          {
            "name": "HPSBUX02476",
            "refsource": "HP",
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "35853",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/35853"
          },
          {
            "name": "RHSA-2009:1637",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html"
          },
          {
            "name": "RHSA-2009:1694",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2009-1694.html"
          },
          {
            "name": "35852",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/35852"
          },
          {
            "name": "35854",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/35854"
          },
          {
            "name": "34461",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/34461"
          },
          {
            "name": "http://www.kb.cert.org/vuls/id/WDON-7TY529",
            "refsource": "CONFIRM",
            "url": "http://www.kb.cert.org/vuls/id/WDON-7TY529"
          },
          {
            "name": "http://www.mono-project.com/Vulnerabilities",
            "refsource": "CONFIRM",
            "url": "http://www.mono-project.com/Vulnerabilities"
          },
          {
            "name": "1020710",
            "refsource": "SUNALERT",
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1"
          },
          {
            "name": "USN-903-1",
            "refsource": "UBUNTU",
            "url": "http://www.ubuntu.com/usn/USN-903-1"
          },
          {
            "name": "35671",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/35671"
          },
          {
            "name": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527",
            "refsource": "CONFIRM",
            "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527"
          },
          {
            "name": "ADV-2010-0366",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2010/0366"
          },
          {
            "name": "55907",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/55907"
          },
          {
            "name": "MDVSA-2009:209",
            "refsource": "MANDRIVA",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
          },
          {
            "name": "SUSE-SA:2010:017",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html"
          },
          {
            "name": "38567",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/38567"
          },
          {
            "name": "FEDORA-2009-8329",
            "refsource": "FEDORA",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
          },
          {
            "name": "263429",
            "refsource": "SUNALERT",
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1"
          },
          {
            "name": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161",
            "refsource": "CONFIRM",
            "url": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161"
          },
          {
            "name": "SSRT090250",
            "refsource": "HP",
            "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
          },
          {
            "name": "ADV-2009-1900",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2009/1900"
          },
          {
            "name": "1022561",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id?1022561"
          },
          {
            "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
          },
          {
            "name": "37671",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/37671"
          },
          {
            "name": "VU#466161",
            "refsource": "CERT-VN",
            "url": "http://www.kb.cert.org/vuls/id/466161"
          },
          {
            "name": "1022567",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id?1022567"
          },
          {
            "name": "RHSA-2009:1636",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html"
          },
          {
            "name": "PK80627",
            "refsource": "AIXAPAR",
            "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023723\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
          },
          {
            "name": "RHSA-2009:1649",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html"
          },
          {
            "name": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html"
          },
          {
            "name": "TA09-294A",
            "refsource": "CERT",
            "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
          },
          {
            "name": "ADV-2009-1909",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2009/1909"
          },
          {
            "name": "ADV-2010-0635",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2010/0635"
          },
          {
            "name": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision",
            "refsource": "CONFIRM",
            "url": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision"
          },
          {
            "name": "38568",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/38568"
          },
          {
            "name": "36180",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/36180"
          },
          {
            "name": "FEDORA-2009-8456",
            "refsource": "FEDORA",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html"
          },
          {
            "name": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03",
            "refsource": "CONFIRM",
            "url": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03"
          },
          {
            "name": "USN-826-1",
            "refsource": "UBUNTU",
            "url": "https://usn.ubuntu.com/826-1/"
          },
          {
            "name": "37841",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/37841"
          },
          {
            "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
          },
          {
            "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
            "refsource": "CONFIRM",
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
          },
          {
            "name": "35855",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/35855"
          },
          {
            "name": "FEDORA-2009-8473",
            "refsource": "FEDORA",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html"
          },
          {
            "name": "36176",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/36176"
          },
          {
            "name": "oval:org.mitre.oval:def:7158",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158"
          },
          {
            "name": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html",
            "refsource": "MISC",
            "url": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html"
          },
          {
            "name": "ADV-2009-1908",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2009/1908"
          },
          {
            "name": "FEDORA-2009-8337",
            "refsource": "FEDORA",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
          },
          {
            "name": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7",
            "refsource": "CONFIRM",
            "url": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925"
          },
          {
            "name": "41818",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/41818"
          },
          {
            "name": "1022661",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id?1022661"
          },
          {
            "name": "37300",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/37300"
          },
          {
            "name": "ADV-2009-1911",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2009/1911"
          },
          {
            "name": "APPLE-SA-2009-09-03-1",
            "refsource": "APPLE",
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
          },
          {
            "name": "SUSE-SA:2009:053",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
          },
          {
            "name": "oval:org.mitre.oval:def:8717",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717"
          },
          {
            "name": "RHSA-2009:1201",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
          },
          {
            "name": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7",
            "refsource": "CONFIRM",
            "url": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
          },
          {
            "name": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ",
            "refsource": "CONFIRM",
            "url": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ"
          },
          {
            "name": "TA10-159B",
            "refsource": "CERT",
            "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"
          },
          {
            "name": "oval:org.mitre.oval:def:10186",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186"
          },
          {
            "name": "55895",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/55895"
          },
          {
            "name": "http://www.aleksey.com/xmlsec/",
            "refsource": "CONFIRM",
            "url": "http://www.aleksey.com/xmlsec/"
          },
          {
            "name": "MS10-041",
            "refsource": "MS",
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041"
          },
          {
            "name": "38921",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/38921"
          },
          {
            "name": "RHSA-2009:1650",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=511915",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "[1.4-alpha0,1.4.2]",
          "affected_versions": "All versions starting from 1.4-alpha0 up to 1.4.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2018-10-12",
          "description": "This package uses a parameter that defines an HMAC truncation length (`HMACOutputLength`) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.",
          "fixed_versions": [
            "1.4.3"
          ],
          "identifier": "CVE-2009-0217",
          "identifiers": [
            "CVE-2009-0217"
          ],
          "not_impacted": "All versions before 1.4-alpha0, all versions after 1.4.2",
          "package_slug": "maven/org.apache.santuario/xmlsec",
          "pubdate": "2009-07-14",
          "solution": "Upgrade to version 1.4.3 or above.",
          "title": "XML signature HMAC truncation authentication bypass",
          "urls": [
            "http://svn.apache.org/viewvc?view=revision\u0026revision=794013",
            "https://bugzilla.redhat.com/CVE-2009-0217"
          ],
          "uuid": "14840313-e424-49fa-a16a-7510c93c9397"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:application_server:10.1.3.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:application_server:10.1.2.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:bea_product_suite:10.0:mp1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mono_project:mono:2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:weblogic_server_component:10.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:weblogic_server_component:10.0:mp1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.19:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.21:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.28:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.25:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.22:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:bea_product_suite:9.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:bea_product_suite:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mono_project:mono:1.2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mono_project:mono:1.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.19:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.21:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.18:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:application_server:10.1.4.3im:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:bea_product_suite:10.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mono_project:mono:1.2.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mono_project:mono:1.2.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:weblogic_server_component:9.2:mp3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:weblogic_server_component:9.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.16:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.24:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.23:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.23:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:bea_product_suite:9.2:mp3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:bea_product_suite:8.1:sp6:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mono_project:mono:1.2.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mono_project:mono:1.2.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mono_project:mono:1.2.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:weblogic_server_component:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:weblogic_server_component:8.1:sp6:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.18:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.22:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:fp17:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.16:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2009-0217"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "VU#466161",
              "refsource": "CERT-VN",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.kb.cert.org/vuls/id/466161"
            },
            {
              "name": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.w3.org/2008/06/xmldsigcore-errata.html#e03"
            },
            {
              "name": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html"
            },
            {
              "name": "http://www.aleksey.com/xmlsec/",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.aleksey.com/xmlsec/"
            },
            {
              "name": "http://www.mono-project.com/Vulnerabilities",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.mono-project.com/Vulnerabilities"
            },
            {
              "name": "ADV-2009-1911",
              "refsource": "VUPEN",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.vupen.com/english/advisories/2009/1911"
            },
            {
              "name": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47527"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026uid=swg21384925"
            },
            {
              "name": "1022561",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id?1022561"
            },
            {
              "name": "PK80596",
              "refsource": "AIXAPAR",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023545\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
            },
            {
              "name": "PK80627",
              "refsource": "AIXAPAR",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www-01.ibm.com/support/docview.wss?rs=180\u0026context=SSEQTP\u0026dc=D400\u0026uid=swg24023723\u0026loc=en_US\u0026cs=UTF-8\u0026lang=en\u0026rss=ct180websphere"
            },
            {
              "name": "ADV-2009-1908",
              "refsource": "VUPEN",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.vupen.com/english/advisories/2009/1908"
            },
            {
              "name": "55895",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/55895"
            },
            {
              "name": "35776",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/35776"
            },
            {
              "name": "ADV-2009-1900",
              "refsource": "VUPEN",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.vupen.com/english/advisories/2009/1900"
            },
            {
              "name": "55907",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/55907"
            },
            {
              "name": "1022567",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id?1022567"
            },
            {
              "name": "35855",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/35855"
            },
            {
              "name": "35853",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/35853"
            },
            {
              "name": "35854",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/35854"
            },
            {
              "name": "35858",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/35858"
            },
            {
              "name": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ"
            },
            {
              "name": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161"
            },
            {
              "name": "http://www.kb.cert.org/vuls/id/WDON-7TY529",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.kb.cert.org/vuls/id/WDON-7TY529"
            },
            {
              "name": "263429",
              "refsource": "SUNALERT",
              "tags": [],
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1"
            },
            {
              "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"
            },
            {
              "name": "35671",
              "refsource": "BID",
              "tags": [
                "Patch"
              ],
              "url": "http://www.securityfocus.com/bid/35671"
            },
            {
              "name": "RHSA-2009:1201",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html"
            },
            {
              "name": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=47526"
            },
            {
              "name": "36180",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/36180"
            },
            {
              "name": "RHSA-2009:1200",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html"
            },
            {
              "name": "ADV-2009-1909",
              "refsource": "VUPEN",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.vupen.com/english/advisories/2009/1909"
            },
            {
              "name": "1022661",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id?1022661"
            },
            {
              "name": "36162",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/36162"
            },
            {
              "name": "35852",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/35852"
            },
            {
              "name": "36176",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/36176"
            },
            {
              "name": "FEDORA-2009-8329",
              "refsource": "FEDORA",
              "tags": [],
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"
            },
            {
              "name": "FEDORA-2009-8337",
              "refsource": "FEDORA",
              "tags": [],
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"
            },
            {
              "name": "FEDORA-2009-8456",
              "refsource": "FEDORA",
              "tags": [],
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html"
            },
            {
              "name": "FEDORA-2009-8473",
              "refsource": "FEDORA",
              "tags": [],
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html"
            },
            {
              "name": "MDVSA-2009:209",
              "refsource": "MANDRIVA",
              "tags": [],
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"
            },
            {
              "name": "36494",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/36494"
            },
            {
              "name": "APPLE-SA-2009-09-03-1",
              "refsource": "APPLE",
              "tags": [],
              "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"
            },
            {
              "name": "ADV-2009-2543",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2009/2543"
            },
            {
              "name": "TA09-294A",
              "refsource": "CERT",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html"
            },
            {
              "name": "ADV-2009-3122",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2009/3122"
            },
            {
              "name": "SUSE-SA:2009:053",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"
            },
            {
              "name": "269208",
              "refsource": "SUNALERT",
              "tags": [],
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1"
            },
            {
              "name": "HPSBUX02476",
              "refsource": "HP",
              "tags": [],
              "url": "http://marc.info/?l=bugtraq\u0026m=125787273209737\u0026w=2"
            },
            {
              "name": "37300",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/37300"
            },
            {
              "name": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
            },
            {
              "name": "RHSA-2009:1428",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1428.html"
            },
            {
              "name": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7"
            },
            {
              "name": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://svn.apache.org/viewvc?revision=794013\u0026view=revision"
            },
            {
              "name": "RHSA-2009:1649",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html"
            },
            {
              "name": "RHSA-2009:1637",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=511915",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915"
            },
            {
              "name": "RHSA-2009:1636",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html"
            },
            {
              "name": "37671",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/37671"
            },
            {
              "name": "RHSA-2009:1650",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html"
            },
            {
              "name": "37841",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/37841"
            },
            {
              "name": "RHSA-2009:1694",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://www.redhat.com/support/errata/RHSA-2009-1694.html"
            },
            {
              "name": "38567",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/38567"
            },
            {
              "name": "38568",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/38568"
            },
            {
              "name": "ADV-2010-0366",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2010/0366"
            },
            {
              "name": "DSA-1995",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "http://www.debian.org/security/2010/dsa-1995"
            },
            {
              "name": "http://www.openoffice.org/security/cves/CVE-2009-0217.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.openoffice.org/security/cves/CVE-2009-0217.html"
            },
            {
              "name": "38695",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/38695"
            },
            {
              "name": "USN-903-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "http://www.ubuntu.com/usn/USN-903-1"
            },
            {
              "name": "SUSE-SA:2010:017",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html"
            },
            {
              "name": "38921",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/38921"
            },
            {
              "name": "ADV-2010-0635",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2010/0635"
            },
            {
              "name": "1020710",
              "refsource": "SUNALERT",
              "tags": [],
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1"
            },
            {
              "name": "TA10-159B",
              "refsource": "CERT",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"
            },
            {
              "name": "34461",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/34461"
            },
            {
              "name": "GLSA-201408-19",
              "refsource": "GENTOO",
              "tags": [],
              "url": "http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml"
            },
            {
              "name": "60799",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/60799"
            },
            {
              "name": "41818",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/41818"
            },
            {
              "name": "oval:org.mitre.oval:def:8717",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717"
            },
            {
              "name": "oval:org.mitre.oval:def:7158",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158"
            },
            {
              "name": "oval:org.mitre.oval:def:10186",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186"
            },
            {
              "name": "USN-826-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "https://usn.ubuntu.com/826-1/"
            },
            {
              "name": "MS10-041",
              "refsource": "MS",
              "tags": [],
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2018-10-12T21:49Z",
      "publishedDate": "2009-07-14T23:30Z"
    }
  }
}