CVE-2023-36661

HIGH7.5EPSS 60.7%

xmltooling - security update

Published: 6/25/2023Modified: 3/9/2026

Also known as:DSA-5432-1DEBIAN-CVE-2023-36661DLA-3464-1

Description

Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)

Affected packages (3)

Debian/xmltoolingfrom 0, < 3.2.0-3+deb11u1
Debian/xmltoolingfrom 0, < 3.0.4-1+deb10u2
Debian/xmltoolingfrom 0, < 3.2.3-1+deb12u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2023-36661