GUACAMOLE-1859: Update xmlsec to 2.2.6 (transitive dependency of SAML).

doc/licenses/apache-santuario-2.2.3/dep-coordinates.txt

@@ -1 +0,0 @@
-org.apache.santuario:xmlsec:jar:2.2.3

doc/licenses/apache-santuario-2.2.6/NOTICE

@@ -1,5 +1,5 @@
 Apache Santuario - XML Security for Java
-Copyright 1999-2021 The Apache Software Foundation
+Copyright 1999-2022 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).
@@ -10,3 +10,5 @@ Data Communications Systems, <http://www.nue.et-inf.uni-siegen.de/>.
 The development of this software was partly funded by the European 
 Commission in the <WebSig> project in the ISIS Programme. 
 
+This product contains software that is
+copyright (c) 2021, Oracle and/or its affiliates.

doc/licenses/apache-santuario-2.2.6/README

@@ -1,7 +1,7 @@
 Apache Santuario (https://santuario.apache.org/)
 -------------------------------------------------
 
-    Version: 2.2.3
+    Version: 2.2.6
     From: 'Apache Software Foundation' (https://www.apache.org/)
     License(s):
         Apache v2.0

doc/licenses/apache-santuario-2.2.6/dep-coordinates.txt

@@ -0,0 +1 @@
+org.apache.santuario:xmlsec:jar:2.2.6

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/pom.xml

@@ -74,15 +74,26 @@
             <groupId>com.onelogin</groupId>
             <artifactId>java-saml</artifactId>
             <version>2.9.0</version>
-            <!--
-                Replace vulnerable version of Woodstox until upstream
-                releases a version with fixed dependencies
-            -->
             <exclusions>
+
+                <!--
+                    Replace vulnerable version of Woodstox until upstream
+                    releases a version with fixed dependencies
+                -->
                 <exclusion>
                     <groupId>com.fasterxml.woodstox</groupId>
                     <artifactId>woodstox-core</artifactId>
                 </exclusion>
+
+                <!--
+                    Replace vulnerable version of xmlsec until upstream
+                    releases a version with fixed dependencies
+                -->
+                <exclusion>
+                    <groupId>org.apache.santuario</groupId>
+                    <artifactId>xmlsec</artifactId>
+                </exclusion>
+
             </exclusions>
         </dependency>
 
@@ -93,6 +104,13 @@
             <version>5.4.0</version>
         </dependency>
 
+        <!-- Apache XML Security for Java -->
+        <dependency>
+            <groupId>org.apache.santuario</groupId>
+            <artifactId>xmlsec</artifactId>
+            <version>2.2.6</version>
+        </dependency>
+
     </dependencies>
 
 </project>