CVE-2018-0489
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on...
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
- Record
CVE-2018-0489- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
CVE List No score
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
- Record
CVE-2018-0489- Updated
- 2026-11-02
EUVDEUVD-2018-1312 No score
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
- Record
EUVD-2018-1312- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4479-q654-wmq5
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on...
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
- Record
GHSA-4479-q654-wmq5- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSV
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
- Record
CVE-2018-0489- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-0489
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
- Record
DEBIAN-CVE-2018-0489- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-0489
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
- Record
UBUNTU-CVE-2018-0489- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11523-1 No score
libxmltooling-devel-3.2.0-1.2 on GA media
These are all security issues fixed in the libxmltooling-devel-3.2.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11523-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0720-1 No score
Security update for xmltooling
This update for xmltooling fixes the following issues:
- CVE-2018-0489: Fixed a security bug when xmltooling mishandled digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486. (bsc#1083247)
- Record
SUSE-SU-2018:0720-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xmltoolingDebian:12 |
before 1.6.4-1 | 1.6.4-1 |
xmltoolingDebian:13 |
before 1.6.4-1 | 1.6.4-1 |
xmltoolingDebian:14 |
before 1.6.4-1 | 1.6.4-1 |
xmltoolingDebian:7 |
before 1.4.2-5+deb7u3, plus listed versions 1.4.2-51.4.2-5+deb7u11.4.2-5+deb7u2 |
1.4.2-5+deb7u3 |
xmltoolingDebian:8 |
before 1.5.3-2+deb8u3, plus listed versions 1.5.3-21.5.3-2+deb8u11.5.3-2+deb8u2 |
1.5.3-2+deb8u3 |
xmltoolingDebian:9 |
before 1.6.0-4+deb9u1, plus listed versions 1.6.0-41.6.0-4+deb9u1~bpo8+1 |
1.6.0-4+deb9u1 |
xmltoolingSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 From an advisory covering 2 CVEs |
before 1.5.6-3.6.1 | 1.5.6-3.6.1 |
xmltoolingSUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 2 CVEs |
before 1.5.6-3.6.1 | 1.5.6-3.6.1 |
xmltoolingSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 2 CVEs |
before 1.5.6-3.6.1 | 1.5.6-3.6.1 |
xmltoolingSUSE:Linux Enterprise Server 12 SP2 From an advisory covering 2 CVEs |
before 1.5.6-3.6.1 | 1.5.6-3.6.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xmltoolingSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 2 CVEs |
before 1.5.6-3.6.1 | 1.5.6-3.6.1 |
xmltoolingSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 2 CVEs |
before 1.5.6-3.6.1 | 1.5.6-3.6.1 |
xmltoolingSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 2 CVEs |
before 1.5.6-3.6.1 | 1.5.6-3.6.1 |
xmltoolingUbuntu:14.04:LTS |
before 1.5.3-2+deb8u3build0.14.04.1, plus listed versions 1.5.3-21.5.3-2+deb8u1build0.14.04.11.5.3-2+deb8u2build0.14.04.1 |
1.5.3-2+deb8u3build0.14.04.1 |
xmltoolingUbuntu:16.04:LTS |
before 1.5.6-2ubuntu0.2, plus listed versions 1.5.3-2.1ubuntu21.5.6-11.5.6-21.5.6-2ubuntu0.1 |
1.5.6-2ubuntu0.2 |
xmltoolingopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 3.2.0-1.2 | 3.2.0-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-0489 is a medium vulnerability (CVSS 6.5) in Shibboleth Xmltooling-c, published February 27, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.11%, the 81st percentile. Fixed in xmltooling 1.6.4-1.
References
securitytracker.com/id/1040435
securityfocus.com/bid/103172
debian.org/security/2018/dsa-4126
shibboleth.net/community/advisories/secadv_20180227.txt
arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt
lists.debian.org/debian-lts-announce/2018/02/msg00031.html
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-0489
github.com/advisories/GHSA-4479-q654-wmq5
security-tracker.debian.org/tracker/CVE-2018-0489
suse.com/support/update/announcement/2018/suse-su-20180720-1
bugzilla.suse.com/1083247
ubuntu.com/security/CVE-2018-0489
issues.shibboleth.net/jira/browse/CPPXT-128
cve.org/CVERecord?id=CVE-2018-0489