CVE-2018-0489

NameCVE-2018-0489
DescriptionShibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1296-1, DSA-4126-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xmltooling (PTS)jessie (security), jessie1.5.3-2+deb8u3fixed
stretch (security), stretch1.6.0-4+deb9u1fixed
buster, sid3.0.2-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xmltoolingsource(unstable)1.6.4-1medium
xmltoolingsourcejessie1.5.3-2+deb8u3mediumDSA-4126-1
xmltoolingsourcestretch1.6.0-4+deb9u1mediumDSA-4126-1
xmltoolingsourcewheezy1.4.2-5+deb7u3mediumDLA-1296-1

Notes

https://shibboleth.net/community/advisories/secadv_20180227.txt
https://issues.shibboleth.net/jira/browse/CPPXT-128
https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
https://www.kb.cert.org/vuls/id/475445

Search for package or bug name: Reporting problems