Security Bulletin: Apache Santuario as used in IBM QRadar SIEM is vulnerable to improper input validation (CVE-2019-12400)

Summary

Apache Santuario as used in IBM QRadar SIEM is vulnerable to improper input validation

Vulnerability Details

CVEID:CVE-2019-12400
**DESCRIPTION:**Apache Santuario XML Security for Java could allow a remote attacker to bypass security restrictions, caused by the loading of XML parsing code from an untrusted source. An attacker could exploit this vulnerability to launch further attacks on the system when validating signed documents.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/165748 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

IBM QRadar 7.3.0 to 7.3.3 Patch 5

IBM QRadar 7.4.0 to 7.4.1 Patch 1

Remediation/Fixes

QRadar / QRM / QVM / QRIF / QNI 7.3.3 Patch 6
QRadar / QRM / QVM / QRIF / QNI 7.4.1 Patch 2
QRadar / QRM / QVM / QRIF / QNI 7.4.2 GA

Workarounds and Mitigations

None