| Package | Affected versions | Patched versions |
|---|---|---|
| xml security for c++ | = 1.6.0 | |
| shibboleth-sp | = 1.3.1= 1.3.2= 1.3.3= 1.3.4= 1.3.5= 1.3f= 2.0= 2.1= 2.2= 2.2.1= 2.3= 2.3.1= 2.4= 2.4.1≤ 2.4.2 |
Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer overflow.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free