CVE-2019-9628

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-11 · updated 2026-06-17
Weakness: CWE-755

Description

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
openSUSE Leap: 15.0, 42.3
Xmltooling Project Xmltooling: before 3.0.4 — fixed in 3.0.4

How to fix

Upgrade to a fixed version: Xmltooling Project Xmltooling 3.0.4. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.html
https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912
https://security.netapp.com/advisory/ntap-20190611-0003/
https://shibboleth.net/community/advisories/secadv_20190311.txt
https://usn.ubuntu.com/3921-1/
https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisories
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.html
https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912
https://security.netapp.com/advisory/ntap-20190611-0003/
https://shibboleth.net/community/advisories/secadv_20190311.txt

Get alerted when CVE-2019-9628 or the next vulnerability affects your stack