PT-2019-1892 · Shibboleth+2 · Shibboleth Service Provider+4

Publicado 2019-03-06 · Atualizado 2024-06-15 · CVE-2019-9628

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions XMLTooling versions prior to 3.0.4

Description The issue is related to the XML parsing class in the XMLTooling library, which is used by OpenSAML and Shibboleth Service Provider software. It occurs when invalid data is present in the XML declaration, causing an unhandled exception in the parser class. This exception is then propagated, leading to an unexpected exception type. The vulnerability can be exploited by a remote attacker to cause a denial of service using a specially crafted XML structure.

Recommendations For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue.

Correção

Improper Handling of Exceptional Conditions

Improper Check for Exceptional Conditions

Enumeração de Fraquezas

CWE-755

CWE-754

Identificadores relacionados

BDU:2019-01546

CVE-2019-9628

DLA-1710-1

DSA-4407-1

GHSA-6HVF-XVWM-VRW4

OPENSUSE-SU-2019:1235-1

OPENSUSE-SU-2019_1235-1

OPENSUSE-SU-2019_1276-1

OPENSUSE-SU-2024:11523-1

SUSE-SU-2019:0928-1

SUSE-SU-2019:0929-1

SUSE-SU-2019_0928-1

SUSE-SU-2019_0929-1

USN-3921-1

Produtos afetados

Opensaml

Shibboleth Service Provider

Suse

Ubuntu

Xmltooling

Referências · 33

• https://osv.dev/vulnerability/UBUNTU-CVE-2019-9628 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2019/suse-su-20190928-1 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-9628 · Aviso do Fabricante
• https://bugzilla.suse.com/1129537 · Nota
• https://suse.com/security/cve/CVE-2018-0489 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2019:0928-1 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20190611-0003 · Nota
• https://issues.shibboleth.net/jira/browse/CPPXT-143 · Nota
• https://suse.com/support/update/announcement/2019/suse-su-20190929-1 · Nota
• https://ubuntu.com/security/CVE-2019-9628 · Aviso do Fabricante
• https://shibboleth.net/community/advisories/secadv_20190311.txt · Nota
• https://usn.ubuntu.com/3921-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-9628 · Aviso do Fabricante