CVEvulnerability
CVE-2018-0486
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-01-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-347
Description
Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.
Affected configurations
• shibboleth xmltooling-c (< 1.6.3)
• debian debian linux 7.0
• debian debian linux 8.0
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-347 Improper Verification of Cryptographic Signature weakness
References
- http://www.securitytracker.com/id/1040177 Third Party Advisory, VDB Entry
- https://lists.debian.org/debian-lts-announce/2018/01/msg00016.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-security-announce/2018/msg00007.html Mailing List, Third Party Advisory
- https://shibboleth.net/community/advisories/secadv_20180112.txt Vendor Advisory
- https://www.debian.org/security/2018/dsa-4085 Third Party Advisory
- http://www.securitytracker.com/id/1040177 Third Party Advisory, VDB Entry
- https://lists.debian.org/debian-lts-announce/2018/01/msg00016.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-security-announce/2018/msg00007.html Mailing List, Third Party Advisory
- https://shibboleth.net/community/advisories/secadv_20180112.txt Vendor Advisory
- https://www.debian.org/security/2018/dsa-4085 Third Party Advisory