Summary
Jurien de Jong discovered that XMLTooling did not properly handle certain
KeyInfo element content within an XML signature. An attacker could possibly
use this issue to achieve server-side request forgery.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | xmltooling | 1.5.6-2ubuntu0.3+esm1 |
Vulnerabilities 1
-
High 7.5CVE-2023-36661 Public exploit
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyI…
References
-
report
https://ubuntu.com/security/CVE-2023-36661