CVE-2018-0489: Medium severity shibboleth xmltooling-c vulnerability
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this Shibboleth XMLTooling-C vulnerability?
The vulnerability ID for this Shibboleth XMLTooling-C vulnerability is CVE-2018-0489.
What is the severity of CVE-2018-0489?
The severity of CVE-2018-0489 is medium.
How does this vulnerability affect Shibboleth Service Provider?
This vulnerability affects Shibboleth Service Provider before 2.6.1.4 on Windows and other products.
How can this vulnerability be exploited?
This vulnerability can be exploited by remote attackers using crafted XML data to obtain sensitive information or conduct impersonation attacks.
Are there any remediation steps available for this vulnerability?
Yes, remediation steps are available. Please refer to the provided references for more information.