~ / search / GHSA-v723-58jv-2qc4

GHSA-v723-58jv-2qc4

Exposure of Sensitive Information to an Unauthorized Actor in OpenSAML

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-6440

Packages

EcosystemPackageAffectedFixed in
Maven org.opensaml:opensaml < 2.6.1 2.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.

References

External links from the advisory. They lead to third-party sites.