Vulnerability in opensaml2 - security update
Summary
DSA-3321-2: opensaml2 - security update. Affects opensaml2 versions < 2.4.3-4+deb7u1. Fixed in 2.4.3-4+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The opensaml2 package is a C++ XML parsing library used for handling XML data. It is commonly used in applications that require XML parsing and processing. The package provides functionality for parsing, validating, and manipulating XML documents. However, a vulnerability has been discovered in the XMLTooling component of opensaml2. This vulnerability allows remote attackers to cause a denial of service (crash) by exploiting a flaw in the handling of well-formed but schema-invalid XML data.
Vulnerability Detail
The vulnerability in opensaml2 arises from a flaw in the XMLTooling library's exception handling mechanism. When parsing well-formed but schema-invalid XML data, the library fails to handle an exception properly. This can be exploited by remote attackers to crash the application using crafted XML data. The impact of this vulnerability is a denial of service, as the application becomes unresponsive or crashes. The vulnerability affects versions 0 to 2.4.3-4+deb7u1 of opensaml2 in the Debian 7 (wheezy) ecosystem, and versions 0 to 2.5.3-2+deb8u1 in the Debian 8 (jessie) ecosystem.
How To Fix
Minimum fixed version
2.4.3-4+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opensaml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, opensaml2 is vulnerable to a denial of service (crash) attack due to a flaw in the handling of well-formed but schema-invalid XML data. To mitigate this vulnerability, it is crucial to upgrade the opensaml2 package to the fixed versions specified for the respective Debian ecosystems. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opensaml2 →
FAQ
opensaml2 is a C++ XML parsing library used for handling XML data. It provides functionality for parsing, validating, and manipulating XML documents.
The vulnerability allows remote attackers to cause a denial of service (crash) by exploiting a flaw in the handling of well-formed but schema-invalid XML data.
The vulnerability affects versions 0 to 2.4.3-4+deb7u1 in the Debian 7 (wheezy) ecosystem, and versions 0 to 2.5.3-2+deb8u1 in the Debian 8 (jessie) ecosystem.
To fix this vulnerability, upgrade the opensaml2 package to the fixed versions: 2.4.3-4+deb7u1 or later for Debian 7 (wheezy), and 2.5.3-2+deb8u1 or later for Debian 8 (jessie).
No workaround is available for this vulnerability. It is recommended to upgrade the opensaml2 package to the fixed versions.
Related vulnerabilities
Recent vulnerabilities recorded for opensaml2.
