Описание
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | XMLTooling | Not affected | ||
| Red Hat JBoss Data Virtualization 6 | XMLTooling | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 6 | XMLTooling | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 7 | xmltooling | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | xmltooling | Not affected | ||
| Red Hat JBoss Fuse 6 | xmltooling | Out of support scope | ||
| Red Hat Single Sign-On 7 | xmltooling | Not affected |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-918
https://bugzilla.redhat.com/show_bug.cgi?id=2217435XMLTooling: SSRF via a crafted KeyInfo element
Связанные уязвимости
CVSS3: 7.5
ubuntu
больше 2 лет назад
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)
CVSS3: 7.5
nvd
больше 2 лет назад
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)
CVSS3: 7.5
debian
больше 2 лет назад
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth ...
