GHSA-6hvf-xvwm-vrw4

Source

https://github.com/advisories/GHSA-6hvf-xvwm-vrw4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6hvf-xvwm-vrw4/GHSA-6hvf-xvwm-vrw4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6hvf-xvwm-vrw4

Withdrawn

2023-08-01T18:26:15Z

Published

2022-05-13T01:02:16Z

Modified

2024-02-17T05:28:27.453176Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

XMLTooling Library Incorrectly Handles Some Exceptions

Details

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-18T23:18:21Z",
    "cwe_ids": [
        "CWE-755"
    ],
    "severity": "HIGH",
    "nvd_published_at": "2019-04-11T20:29:00Z"
}

References

Affected packages

Maven / org.opensaml:xmltooling

Package

Name: org.opensaml:xmltooling; View open source insights on deps.dev
Purl: pkg:maven/org.opensaml/xmltooling

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.4

Affected versions

1.*

1.3.1

1.3.2

1.3.2-1

1.3.4

1.4.0

1.4.1

1.4.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6hvf-xvwm-vrw4/GHSA-6hvf-xvwm-vrw4.json"