The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in multiple products.
The Apache XML Security (Java) is affected by the vulnerability published in US-Cert VU #466161. See: http://www.kb.cert.org/vuls/id/466161 for more information. This bug can allow an attacker to bypass authentication by inserting/modifying a small HMAC truncation length parameter in the XML Signature HMAC based SignatureMethod algorithms.
An inexhaustive list of additional affected products includes:
www.us-cert.gov/cas/techalerts/TA10-159B.html
bugzilla.redhat.com/show_bug.cgi?id=511915
docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041
gitlab.gnome.org/Archive/xmlsec/-/commit/34b349675af9f72eb822837a8772cc1ead7115c7
issues.apache.org/bugzilla/show_bug.cgi?id=47526
issues.apache.org/bugzilla/show_bug.cgi?id=47527
lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html
marc.info/?l=bugtraq&m=125787273209737&w=2
nvd.nist.gov/vuln/detail/CVE-2009-0217
rhn.redhat.com/errata/RHSA-2009-1428.html
svn.apache.org/viewvc?revision=794013&view=revision
www.debian.org/security/2010/dsa-1995
www.gentoo.org/security/en/glsa/glsa-201408-19.xml
www.kb.cert.org/vuls/id/466161
www.kb.cert.org/vuls/id/MAPG-7TSKXQ
www.kb.cert.org/vuls/id/WDON-7TY529
www.mandriva.com/security/advisories?name=MDVSA-2009:209
www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html
www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html
www.redhat.com/support/errata/RHSA-2009-1694.html
www.ubuntu.com/usn/USN-903-1
www.us-cert.gov/cas/techalerts/TA09-294A.html
www.w3.org/2008/06/xmldsigcore-errata.html#e03
www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html