Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade xmltooling | Jul 4, 2023 | Jun 25, 2023 |
| Suse | — | Upgrade libxmltooling-develUpgrade libxmltooling6Upgrade libxmltooling7Upgrade xmltooling-schemasUpgrade libxmltooling9Upgrade libxmltooling-lite9 | Jul 4, 2023 | Jun 25, 2023 |
| Ubuntu | — | Upgrade libxmltooling6v5 (Ubuntu Pro) | Aug 4, 2023 | Jun 25, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub