Description
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | hornetq | 2.3.14-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jacorb-jboss | 2.3.2-13.redhat_6.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-as-cli +6 | 7.3.1-4.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-as-cmp +25 | 7.3.1-2.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-as-ee +19 | 7.3.1-3.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-logmanager | 1.5.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-marshalling | 1.4.3-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-xnio-base | 3.0.9-1.GA_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jbossas-core | 7.3.1-5.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.3.1-3.Final_redhat_3.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jbossas-modules-eap | 7.3.1-6.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jbossweb | 7.3.0-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | netty | 3.6.7-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.19-2.SP3_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.17-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | xml-security | 1.5.6-1.redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | xmltooling | 1.3.4-5.redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.opensaml:opensaml | < 2.6.1 | 2.6.1 | GHSA-v723-58jv-2qc4 |
Advisories 2
- RHSA-2014:0170 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0171 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2014:0170 vendor-advisory
- RHSA-2014:0195 vendor-advisory
- RHSA-2014:0172 vendor-advisory
- RHSA-2014:0171 vendor-advisory
- https://www.oracle.com/security-alerts/cpujan2022.html
- http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml
- http://shibboleth.net/community/advisories/secadv_20131213.txt
- https://bugzilla.redhat.com/show_bug.cgi?id=1043332