[NIFI-12259] Upgrade Santuario XML to 2.3.4

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.0-M1, 1.24.0
• Component/s: Core Framework
• Labels: dependency-upgrade
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 20/Oct/23 17:01
• Updated: 23/Oct/23 08:30
• Resolved: 23/Oct/23 08:30

Description

Apache Santuario 2.3.4 includes a resolution for CVE-2023-44483, which relates to logging sensitive private key information at the debug level. Spring Security SAML2 has a dependency on Apache Santuario, which should be upgraded.

Issue Links

• links to: GitHub Pull Request #7916