CVE-2019-9628
xmltooling - security update
7.5
HIGH
CVSS 3.1
EPSS 0.80%
Description
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
How to fix CVE-2019-9628
To remediate CVE-2019-9628, upgrade the affected package to a fixed version below.
- —upgrade to 3.0.4-1 or later
- —upgrade to 1.5.3-2+deb8u4 or later
- —upgrade to 1.6.0-4+deb9u2 or later
Is CVE-2019-9628 being exploited?
Low — EPSS is 0.8%, meaning exploitation activity has not been observed at scale.
Affected packages (3)
- from 0, < 3.0.4-1
- from 0, < 1.5.3-2+deb8u4
- from 0, < 1.6.0-4+deb9u2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |