CVE-2013-6440: Infoleak
First published: Mon Dec 16 2013(Updated: )
IssueDescription: It was found that the ParserPool and Decrypter classes in the OpenSAML Java implementation resolved external entities, permitting XML External Entity (XXE) attacks. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Internet2 Opensaml | =2.0 | |
| Internet2 Opensaml | =2.1.0 | |
| Internet2 Opensaml | =2.2.0 | |
| Shibboleth OpenSAML | <=2.6.0 | |
| Shibboleth OpenSAML | =2.4.0 | |
| Shibboleth OpenSAML | =2.4.1 | |
| Shibboleth OpenSAML | =2.4.2 | |
| Shibboleth OpenSAML | =2.4.3 | |
| Shibboleth OpenSAML | =2.5.0 | |
| Shibboleth OpenSAML | =2.5.1 | |
| Shibboleth OpenSAML | =2.5.2 | |
| Shibboleth OpenSAML | =2.5.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml
- http://rhn.redhat.com/errata/RHSA-2014-0170.html
- http://rhn.redhat.com/errata/RHSA-2014-0171.html
- http://rhn.redhat.com/errata/RHSA-2014-0172.html
- http://rhn.redhat.com/errata/RHSA-2014-0195.html
- http://shibboleth.net/community/advisories/secadv_20131213.txt
- https://bugzilla.redhat.com/show_bug.cgi?id=1043332
- https://www.oracle.com/security-alerts/cpujan2022.html
- http://svn.shibboleth.net/view/java-xmltooling?view=revision&revision=812
- http://svn.shibboleth.net/view/java-xmltooling?view=revision&revision=815
- https://issues.shibboleth.net/jira/browse/JXT-105
- https://issues.shibboleth.net/jira/browse/JXT-107
- https://rhn.redhat.com/errata/RHSA-2014-0172.html
- https://rhn.redhat.com/errata/RHSA-2014-0171.html
- https://rhn.redhat.com/errata/RHSA-2014-0170.html
- https://rhn.redhat.com/errata/RHSA-2014-0195.html
- https://rhn.redhat.com/errata/RHSA-2014-0452.html
- https://rhn.redhat.com/errata/RHSA-2014-1291.html
- https://rhn.redhat.com/errata/RHSA-2014-1290.html
- https://rhn.redhat.com/errata/RHSA-2014-1995.html
- collector/nvd-index
- agent/softwarecombine
- agent/first-publish-date
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-6440
- agent/tags
- agent/trending
- vendor/internet2
- canonical/internet2 opensaml
- version/internet2 opensaml/2.0
- version/internet2 opensaml/2.1.0
- version/internet2 opensaml/2.2.0
- vendor/shibboleth
- canonical/shibboleth opensaml
- version/shibboleth opensaml/2.6.0
- version/shibboleth opensaml/2.4.0
- version/shibboleth opensaml/2.4.1
- version/shibboleth opensaml/2.4.2
- version/shibboleth opensaml/2.4.3
- version/shibboleth opensaml/2.5.0
- version/shibboleth opensaml/2.5.1
- version/shibboleth opensaml/2.5.2
- version/shibboleth opensaml/2.5.3