CVE-2018-0489 Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to....
MediumCVSS 6.5
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xmltooling(Debian:12) | < 1.6.4-1 | 1.6.4-1 |
| debian/xmltooling(Debian:13) | < 1.6.4-1 | 1.6.4-1 |
| debian/xmltooling(Debian:14) | < 1.6.4-1 | 1.6.4-1 |
| shibboleth xmltooling-c | < 1.6.4 | 1.6.4 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| arubanetworks clearpass | >= 6.6.0, <= 6.6.9 | No fix listed |
| arubanetworks clearpass | >= 6.7.0, < 6.7.2 | 6.7.2 |
References
- Debian Security Tracker CVE-2018-0489 vendor-advisory
- www.arubanetworks.com third-party-advisory
- 103172 third-party-advisory vdb-entry
- 1040435 third-party-advisory vdb-entry
- [debian-lts-announce] 20180228 [SECURITY] [DLA 1296-1] xmltooling security update issue-tracking mailing-list
- shibboleth.net patch vendor-advisory
- DSA-4126 third-party-advisory vendor-advisory