CVE-2023-36661
Published: 25 June 2023
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)
Priority
Status
| Package | Release | Status |
|---|---|---|
|
xmltooling Launchpad, Ubuntu, Debian |
bionic |
Needed
|
| focal |
Needed
|
|
| jammy |
Needed
|
|
| kinetic |
Ignored
(end of life, was needed)
|
|
| lunar |
Ignored
(end of life, was needed)
|
|
| mantic |
Needs triage
|
|
| trusty |
Needed
|
|
| upstream |
Released
(3.2.4-1)
|
|
| xenial |
Released
(1.5.6-2ubuntu0.3+esm1)
Available with Ubuntu Pro |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
- https://shibboleth.net/community/advisories/secadv_20230612.txt
- https://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=6080f6343f98fec085bc0fd746913ee418cc9d30
- https://ubuntu.com/security/notices/USN-6274-1
- https://www.cve.org/CVERecord?id=CVE-2023-36661
- NVD
- Launchpad
- Debian