Remove call to Signature.getProvider() in debug log #240
Conversation
|
@coheigea and @seanjmullan We are unable to upgrade to 3.0.3 or 4.0.0 to get the fix for CVE-2023-44483 because of this issue. Appreciate your attention to this pull request. |
|
Sorry for the delay. I will take a look now. |
src/main/java/org/apache/xml/security/algorithms/implementations/SignatureBaseRSA.java
Outdated
Show resolved
Hide resolved
The debug log message makes a call to Signature.getProvider() too early. This causes Signature.chooseFirstProvider() to be called which matches the first provider always rather than the correct provider based on PrivateKey.getAlgorithm() when there are multiple providers. This debug log was changed in this commit and introduced the issue: 1f48918 Added unit test cases with fake provider
|
Backmerging to 3.0.x as well. |
The debug log message makes a call to Signature.getProvider() too early. This causes Signature.chooseFirstProvider() to be called which matches the first provider always rather than the correct provider based on PrivateKey.getAlgorithm() when there are multiple providers. This debug log was changed in this commit and introduced the issue: 1f48918 Added unit test cases with fake provider
The debug log message makes a call to Signature.getProvider() too early. This causes Signature.chooseFirstProvider() to be called which matches the first provider always rather than the correct provider based on PrivateKey.getAlgorithm() when there are multiple providers. This debug log was changed in this commit and introduced the issue: 1f48918 Added unit test cases with fake provider
|
@coheigea Is there an ETA for next release ? We are unable to upgrade to latest version to get the CVE fix until this fix included (other than copy-pasting this class into our application to override it) |
|
@narras-oss What release do you specifically need a fix in? |
|
This particular pull request (which is merged) is what I am referring to as the fix, either 3.0.4 or 4.0.1 (next release) would work. |
|
I'm calling a vote on 4.0.1 today with the fix |
|
4.0.1 is in maven central now |
|
@coheigea Do you have ETA when 2.3.5 will be tagged? We have to upgrade to this version to resolve the issue. Thanks! |
|
@ivassile A release vote is now under way on the dev list, please follow that. |
The debug log message makes a call to Signature.getProvider() too early.
This causes Signature.chooseFirstProvider() to be called which matches the first provider always rather than the correct provider based on PrivateKey.getAlgorithm() when there are multiple providers.
This debug log was changed in this commit and introduced the issue: 1f48918
Added unit test cases with fake provider