Vulnerability Details CVE-2018-0486
Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.009
EPSS Ranking 75.0%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 6.4
References
- http://www.securitytracker.com/id/1040177
- https://lists.debian.org/debian-lts-announce/2018/01/msg00016.html
- https://lists.debian.org/debian-security-announce/2018/msg00007.html
- https://shibboleth.net/community/advisories/secadv_20180112.txt
- https://www.debian.org/security/2018/dsa-4085
- http://www.securitytracker.com/id/1040177
- https://lists.debian.org/debian-lts-announce/2018/01/msg00016.html
- https://lists.debian.org/debian-security-announce/2018/msg00007.html
- https://shibboleth.net/community/advisories/secadv_20180112.txt
- https://www.debian.org/security/2018/dsa-4085
Products affected by CVE-2018-0486
-
cpe:2.3:a:shibboleth:xmltooling-c:*
-
cpe:2.3:o:debian:debian_linux:7.0
-
cpe:2.3:o:debian:debian_linux:8.0
-
cpe:2.3:o:debian:debian_linux:9.0