PT-2019-1892 · Shibboleth+2 · Shibboleth Service Provider+4

Published 2019-03-06 · Updated 2024-06-15 · CVE-2019-9628

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions XMLTooling versions prior to 3.0.4

Description The issue is related to the XML parsing class in the XMLTooling library, which is used by OpenSAML and Shibboleth Service Provider software. It occurs when invalid data is present in the XML declaration, causing an unhandled exception in the parser class. This exception is then propagated, leading to an unexpected exception type. The vulnerability can be exploited by a remote attacker to cause a denial of service using a specially crafted XML structure.

Recommendations For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue.

Fix

Improper Handling of Exceptional Conditions

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-754

Related Identifiers

BDU:2019-01546

CVE-2019-9628

DLA-1710-1

DSA-4407-1

GHSA-6HVF-XVWM-VRW4

OPENSUSE-SU-2019:1235-1

OPENSUSE-SU-2019_1235-1

OPENSUSE-SU-2019_1276-1

OPENSUSE-SU-2024:11523-1

SUSE-SU-2019:0928-1

SUSE-SU-2019:0929-1

SUSE-SU-2019_0928-1

SUSE-SU-2019_0929-1

USN-3921-1

Affected Products

Opensaml

Shibboleth Service Provider

Suse

Ubuntu

Xmltooling

References · 33

• https://osv.dev/vulnerability/UBUNTU-CVE-2019-9628 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-9628 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0928-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9628 · Vendor Advisory
• https://usn.ubuntu.com/3921-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9628 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3921-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9628 · Security Note
• https://osv.dev/vulnerability/DSA-4407-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-9628 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1235-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-9628 · Security Note
• https://osv.dev/vulnerability/DLA-1710-1 · Vendor Advisory