CVE-2018-0486

MEDIUM

Shibboleth XMLTooling-C < 1.6.3 - Improper Verification of Cryptographic Signature via Crafted DTD

Title source: llm
STIX 2.1

Description

Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.

References (5)

Core 5
Core References
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4085
Mailing List, Third Party Advisory x_refsource_misc
https://lists.debian.org/debian-security-announce/2018/msg00007.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/01/msg00016.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040177

Scores

CVSS v3 6.5
EPSS 0.0155
EPSS Percentile 71.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Details

CWE
CWE-347
Status published
Products (4)
debian/debian_linux 7.0
debian/debian_linux 8.0
debian/debian_linux 9.0
shibboleth/xmltooling-c < 1.6.3
Published Jan 13, 2018
Tracked Since Feb 18, 2026