XMLTooling Library Incorrectly Handles Some Exceptions

ALTO 7.5CVE-2019-9628 · GHSA-6hvf-xvwm-vrw4 · Published 11/04/2019 · updated 17/06/2026

In breve

CVE-2019-9628 è una vulnerabilità ALTO (CVSS 7.5) che riguarda org.opensaml:xmltooling, xmltooling (xmltooling project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.1%, superiore al 81.3% delle vulnerabilità.
Correzione: aggiornare a 3.0.4 o successiva.

Package	Affected versions	Patched versions
org.opensaml:xmltooling Maven	`< 3.0.4`	`3.0.4`
xmltooling xmltooling_project	`< 3.0.4`	`3.0.4`

Description

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-9628 · ADVISORY
bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912 · WEB
security.netapp.com/advisory/ntap-20190611-0003 · WEB
shibboleth.net/community/advisories/secadv_20190311.txt · WEB
usn.ubuntu.com/3921-1 · WEB
wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisories · WEB
lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html · WEB
lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.html · WEB
security.netapp.com/advisory/ntap-20190611-0003 · Third Party Advisory
usn.ubuntu.com/3921-1 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free