CVE-2018-0489

NameCVE-2018-0489
DescriptionShibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1296-1, DSA-4126-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xmltooling (PTS)buster3.0.4-1+deb10u1fixed
buster (security)3.0.4-1+deb10u2fixed
bullseye (security), bullseye3.2.0-3+deb11u1fixed
bookworm, bookworm (security)3.2.3-1+deb12u1fixed
trixie3.2.4-2fixed
sid3.2.4-2.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xmltoolingsourcewheezy1.4.2-5+deb7u3DLA-1296-1
xmltoolingsourcejessie1.5.3-2+deb8u3DSA-4126-1
xmltoolingsourcestretch1.6.0-4+deb9u1DSA-4126-1
xmltoolingsource(unstable)1.6.4-1

Notes

https://shibboleth.net/community/advisories/secadv_20180227.txt
https://issues.shibboleth.net/jira/browse/CPPXT-128
https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
https://www.kb.cert.org/vuls/id/475445

Search for package or bug name: Reporting problems