CVE-2023-36661: SSRF

Reference Links

• https://shibboleth.net/community/advisories/secadv_20230612.txt
• https://www.debian.org/security/2023/dsa-5432
• https://launchpad.net/bugs/cve/CVE-2023-36661
• https://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=6080f6343f98fec085bc0fd746913ee418cc9d30
• https://security-tracker.debian.org/tracker/CVE-2023-36661
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36661
• https://ubuntu.com/security/notices/USN-6274-1
• https://nvd.nist.gov/vuln/detail/CVE-2023-36661
• https://ubuntu.com/security/CVE-2023-36661

Parent vulnerabilities

(Appears in the following advisories)

• USN-6274-1

Frequently Asked Questions

• What is the vulnerability ID for this vulnerability?

  The vulnerability ID for this vulnerability is CVE-2023-36661.

• What is the severity of CVE-2023-36661?

  The severity of CVE-2023-36661 is high.

• Which software is affected by CVE-2023-36661?

  Shibboleth XMLTooling before version 3.2.4, used in OpenSAML and Shibboleth Service Provider, is affected by CVE-2023-36661.

• How can the vulnerability be fixed?

  The vulnerability can be fixed by updating to a patched version, such as Shibboleth Service Provider 3.4.1.3 on Windows.

• Where can I find more information about CVE-2023-36661?

  You can find more information about CVE-2023-36661 in the following references: [Link 1](https://shibboleth.net/community/advisories/secadv_20230612.txt), [Link 2](https://www.debian.org/security/2023/dsa-5432), [Link 3](https://launchpad.net/bugs/cve/CVE-2023-36661).