CVE-2019-9628: canonical ubuntu_linux
CVSS: 7.5v3.1HighModified
AliasesSUSE-SU-2019:0928-1SUSE-SU-2019:0929-1UBUNTU-CVE-2019-9628USN-3921-1DEBIAN-CVE-2019-9628DLA-1710-1DSA-4407-1openSUSE-SU-2019:1235-1GHSA-6hvf-xvwm-vrw4
Published 11-04-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-9628 is a high (CVSS 7.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 2.05% chance of exploitation in the next 30 days, higher than 80.9% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
2.05%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 11-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
CVSS metrics
6 scores · 4 sources · 3 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesSingle source
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
2.05%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
0.00 pp
From 2.05% on 20-09-2026
20-09-202620-10-2026
EPSS score2.05%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse7 products
- xmltooling&distro=SUSE Linux Enterprise Module for Server Applications 15< 1.6.4-3.3.2
- xmltooling&distro=SUSE Linux Enterprise Server 12 SP3< 1.5.6-3.9.1
- xmltooling&distro=SUSE Linux Enterprise Server 12 SP4< 1.5.6-3.9.1
- xmltooling&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3< 1.5.6-3.9.1
- xmltooling&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 1.5.6-3.9.1
Opensuse2 products
- leapEOL15.0 | 42.3
- xmltooling&distro=openSUSE Leap 15.0< 1.6.4-lp150.2.3.1
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Debian1 product
- xmltooling< 3.0.4-1 | < 1.6.0-4+deb9u2 | < 1.5.3-2+deb8u4
Org.opensaml1 product
- xmltooling< 3.0.4
Ubuntu1 product
- xmltooling< 1.5.3-2+deb8u3ubuntu0.1 | < 1.5.6-2ubuntu0.3 | < 1.6.4-1ubuntu2.1
Xmltooling_project1 product
- xmltooling< 3.0.4
7 vendors · 14 products
References
21 links- shibboleth.net/community/advisories/secadv_20190311.txtX Refsource MISCREPORTWEBThird Party Advisory
- wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisoriesX Refsource MISCWEBThird Party Advisory
- bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912X Refsource MISCWEBIssue TrackingThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
Show all 21 references
- lists.opensuse.org/archives/…Advisory
