Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)
{ "ubuntu_priority": "medium", "binaries": [ { "binary_name": "libxmltooling-dev", "binary_version": "1.5.6-2ubuntu0.3+esm1" }, { "binary_name": "libxmltooling-doc", "binary_version": "1.5.6-2ubuntu0.3+esm1" }, { "binary_name": "libxmltooling6v5", "binary_version": "1.5.6-2ubuntu0.3+esm1" }, { "binary_name": "libxmltooling6v5-dbgsym", "binary_version": "1.5.6-2ubuntu0.3+esm1" }, { "binary_name": "xmltooling-schemas", "binary_version": "1.5.6-2ubuntu0.3+esm1" } ], "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro" }
{ "ubuntu_priority": "medium", "binaries": [ { "binary_name": "libxmltooling-dev", "binary_version": "3.2.4-2.1build3" }, { "binary_name": "libxmltooling-doc", "binary_version": "3.2.4-2.1build3" }, { "binary_name": "libxmltooling10t64", "binary_version": "3.2.4-2.1build3" }, { "binary_name": "libxmltooling10t64-dbgsym", "binary_version": "3.2.4-2.1build3" }, { "binary_name": "xmltooling-schemas", "binary_version": "3.2.4-2.1build3" } ], "availability": "No subscription required" }
{ "ubuntu_priority": "medium", "binaries": [ { "binary_name": "libxmltooling-dev", "binary_version": "3.2.4-2.1build3" }, { "binary_name": "libxmltooling-doc", "binary_version": "3.2.4-2.1build3" }, { "binary_name": "libxmltooling10t64", "binary_version": "3.2.4-2.1build3" }, { "binary_name": "libxmltooling10t64-dbgsym", "binary_version": "3.2.4-2.1build3" }, { "binary_name": "xmltooling-schemas", "binary_version": "3.2.4-2.1build3" } ], "availability": "No subscription required" }