CVE-2019-9628

Name of the Vulnerable Software and Affected Versions XMLTooling versions prior to 3.0.4

Description The issue is related to the XML parsing class in the XMLTooling library, which is used by OpenSAML and Shibboleth Service Provider software. It occurs when invalid data is present in the XML declaration, causing an unhandled exception in the parser class. This exception is then propagated, leading to an unexpected exception type. The vulnerability can be exploited by a remote attacker to cause a denial of service using a specially crafted XML structure.

Recommendations For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue.