CVEvulnerability
CVE-2019-9628
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-04-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-755
Description
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
Affected configurations
• xmltooling project xmltooling (< 3.0.4)
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 18.10
• opensuse leap 15.0
• opensuse leap 42.3
Related
Weakness · CWE (1)
- CWE-755 Improper Handling of Exceptional Conditions weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.html Mailing List, Third Party Advisory
- https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912 Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190611-0003/ Third Party Advisory
- https://shibboleth.net/community/advisories/secadv_20190311.txt Third Party Advisory
- https://usn.ubuntu.com/3921-1/ Third Party Advisory
- https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisories Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.html Mailing List, Third Party Advisory
- https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912 Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190611-0003/ Third Party Advisory
- https://shibboleth.net/community/advisories/secadv_20190311.txt Third Party Advisory
- https://usn.ubuntu.com/3921-1/ Third Party Advisory
- https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisories Third Party Advisory