Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.0583
xmltooling security update
28 February 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: xmltooling
Publisher: Debian
Operating System: Debian GNU/Linux 9
Debian GNU/Linux 8
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-0489
Reference: ESB-2018.0574
ESB-2018.0572
ESB-2018.0571
Original Bulletin:
http://www.debian.org/security/2018/dsa-4126
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4126-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
February 27, 2018 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : xmltooling
CVE ID : CVE-2018-0489
Kelby Ludwig and Scott Cantor discovered that the Shibboleth service
provider is vulnerable to impersonation attacks and information
disclosure due to incorrect XML parsing. For additional details please
refer to the upstream advisory at
https://shibboleth.net/community/advisories/secadv_20180227.txt
For the oldstable distribution (jessie), this problem has been fixed
in version 1.5.3-2+deb8u3.
For the stable distribution (stretch), this problem has been fixed in
version 1.6.0-4+deb9u1.
We recommend that you upgrade your xmltooling packages.
For the detailed security status of xmltooling please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/xmltooling
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqVwHpfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0SmSQ//bQSbS9OIsVPDwdq+6sWrDKqzIfjWDR+F9G/G0/CkrG/08BngwM/pGliO
JRJlbBMwZJResuRl/VRGccLTQ2RFgPjcksXQlPnbJ5j2Q0DDMRj4KWeZnwFkLohJ
FVmJvUGl3awlu72XmbYJYIkXnu50PjM3tIQox28UGaq4D1o+SEjC8/BGUEB93vc3
4Kyxe6801qzq7958JDs0AURI2XRAGPBQ3mgfqgivP/tlrc4PgHGBxu1kZhZBVHYg
VMh97N22NrN8mCOWAD2YWUXww420oUrjP2CW5l2uOSU7PTLvAZ8Mde0iac7BagQz
mqR0O0OKfcdPL5GelwdGmgSVzFUuC1wayvmpGtTbXSQnH/ycnilM6OKTtsqkyPol
MQiEUN6BwAUEDxM0vWWniA3SVzlJZZDWYxyNPRnuADSqEVZ/f7aX/PXyc+yt3OJx
3eVYbU6pxF67eUCKr/wGeqOk/RtBQR7D+a4Swiqr9jilqOkCEF4FPbvJtm/NEYL2
gZlmkb1/WRkpnqvKoT44h5K/sXIalsDhzZnmOgCIEp0Uuh8OIm/pZEcV9seSLsjR
Fwj4Obq2135armau4FLT9b+d2FlR4B3NSVQ23ORK+8Ez99wdBeBDOGIBNqpagU3c
chMO0XNTwRuDR4XUotpPyu1G5VxZj/pktKWFf325viN5YDMUxS4=
=h2EY
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWpYm8ox+lLeg9Ub1AQhopg//dOXC2ffpwHogRtipZIcDWGJxStSIRJt5
zPdNrgMS6myjraYnZx7bJ7Hvdf5WMPGoxHC1sCIhvmyPRSrKX1PjbX01wwyaAhqU
1tzrfKxDUwwkAenpNJAhmF/5Zme+46k+sleCyo+vMkA093jYPmKXyrrIsF98rBWN
nAV2aL0aF3w3wQJ7D71jxs58ZRHFJPFe7DG5jZ7XbC1XSPytsDjNgyAkz7MwzZWd
tOUI67rNy/aP+y1XBRePQhovgLw9QeRXzu7NHHapbJLfrvWMHQzZUu58GaApIAwj
ZDuxECmj/8A/XGeBS/axjF72TAcwqXd0ypVquX7/Px3raX1Th++++7yCYOphZ6EN
0omvtU+qLnsNHhRYvaX7zs8LNiQIjJewegrXzwIAJ8b90TzuAwLhE12Ot/S68rnd
6MIAex1uIgcQqmP9yRM0wtVCz5M6F+FtdGAcjg89Jxgd0KTvryZJtBKjPj/fJjKP
0XFiLGN6g/jowAZC4JxJe2NaAd8T39urNfnrN3QcPv6777ngodd1J5fXmWsfpDP0
fmqUDBFuPNc0zc1MVjoenE24/ZtVPyEiIXzwX7hZ6K4SdXQBWSJpuAyqoQdJ8lvT
XZDj+lfHB2z9FhcZV9GjH41hVxpvLXOGS6zQn6EF5jqPNzduKWDC9unCOUkotc2P
RD/ezUM/9Y8=
=8p2H
-----END PGP SIGNATURE-----