CVE-2019-9628

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 72%
VendorProductVersion
xmltooling_projectxmltooling
𝑥
< 3.0.4
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
18.10
opensuseleap
15.0
opensuseleap
42.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
xmltooling
bullseye (security)
3.2.0-3+deb11u1
fixed
bullseye
3.2.0-3+deb11u1
fixed
bookworm
3.2.3-1+deb12u1
fixed
bookworm (security)
3.2.3-1+deb12u1
fixed
sid
3.2.4-2.1
fixed
trixie
3.2.4-2.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
xmltooling
cosmic
Fixed 3.0.2-1ubuntu1.1
released
bionic
Fixed 1.6.4-1ubuntu2.1
released
xenial
Fixed 1.5.6-2ubuntu0.3
released
trusty
Fixed 1.5.3-2+deb8u3ubuntu0.1
released
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.html
https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912
https://security.netapp.com/advisory/ntap-20190611-0003/
https://shibboleth.net/community/advisories/secadv_20190311.txt
https://usn.ubuntu.com/3921-1/
https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisories
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.html
https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912
https://security.netapp.com/advisory/ntap-20190611-0003/
https://shibboleth.net/community/advisories/secadv_20190311.txt
https://usn.ubuntu.com/3921-1/
https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisories