CVE-2013-6440
Publication date 14 February 2014
Last updated 24 July 2024
Ubuntu priority
Description
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| opensaml2 | ||
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty | Not in release | |