{"id":"CVE-2013-6440","aliases":["EUVD-2022-5302","GHSA-v723-58jv-2qc4","RHSA-2014:0170","RHSA-2014:0171"],"status":"published","title":"Exposure of Sensitive Information to an Unauthorized Actor in OpenSAML","description":"The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02752,"percentile":0.86322,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2014-02-14T15:00:00Z","modified":"2026-08-05T10:02:24Z","fixes":[{"ecosystem":"Maven","package":"org.opensaml:opensaml","fixed_in":["2.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.opensaml:opensaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.opensaml:opensaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1"}]}],"versions":["1.1","2.1.0","2.2.0","2.2.1","2.2.3","2.4.1","2.5.1","2.5.1-1","2.5.3","2.6.0"]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossas-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"hornetq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.14-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jacorb-jboss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-13.redhat_6.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-appclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-client-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-clustering","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-cmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-configadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-controller-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-core-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-deployment-repository","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-deployment-scanner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-domain-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-domain-management","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-ee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-ee-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-ejb3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-host-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jacorb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jaxr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jdr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-jsr77","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-management-client-content","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-modcluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-naming","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-osgi-configadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-osgi-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-platform-mbean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-pojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-process-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-remoting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-sar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-system-jmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-threads","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-transactions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-version","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-webservices","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-weld","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-xts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-logmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-marshalling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.3-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-xnio-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.9-1.GA_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossas-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-5.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossas-modules-eap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-6.Final_redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.0-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.7-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"picketbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.19-2.SP3_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"weld-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.17-1.Final_redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.6-1.redhat_1.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.4-5.redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossas-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"hornetq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.14-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jacorb-jboss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-13.redhat_6.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-appclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-client-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-clustering","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-cmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-configadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-controller-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-core-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-deployment-repository","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-deployment-scanner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-domain-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-domain-management","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-ee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-ee-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-ejb3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-host-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jacorb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jaxr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jdr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-jsr77","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-management-client-content","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-modcluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-naming","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-osgi-configadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-osgi-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-platform-mbean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-pojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-process-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-remoting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-sar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-system-jmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-threads","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-transactions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-version","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-webservices","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-3.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-weld","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-4.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-xts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-2.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-logmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-marshalling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.3-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-xnio-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.9-1.GA_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossas-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-5.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossas-modules-eap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.1-6.Final_redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.0-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.7-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"picketbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.19-2.SP3_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"weld-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.17-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.6-1.redhat_1.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.4-5.redhat_3.1.ep6.el6"}]}],"bundled":3}],"products":[{"vendor":"internet2","product":"opensaml"},{"vendor":"shibboleth","product":"opensaml"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2014-0170.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0195.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0172.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0171.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml","tags":["x_refsource_MISC","x_transferred","web","article"]},{"url":"http://shibboleth.net/community/advisories/secadv_20131213.txt","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1043332","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6440","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v723-58jv-2qc4"},{"url":"https://access.redhat.com/errata/RHSA-2014:0170","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/JBoss_Enterprise_Application_Platform/6.2/html/6.2.1_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1038643","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1045257","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052783","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053216","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053231","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053779","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0170.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4517","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4517","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4517","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6440","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6440","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0018","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0018","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0171","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1038647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052717","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052988","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053778","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0171.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-6440","description":"The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.","status":"published","published":"2014-02-14T15:00:00Z","modified":"2024-08-06T17:39:01.299Z","updated_at":"2026-11-02T14:34:57.499208Z"}],"euvd":[{"id":"EUVD-2022-5302","description":"The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.","status":"published","published":"2014-02-14T15:00:00Z","modified":"2024-08-06T17:39:01Z","updated_at":"2026-11-03T01:56:25.766525Z"}],"ghsa":[{"id":"GHSA-v723-58jv-2qc4","title":"Exposure of Sensitive Information to an Unauthorized Actor in OpenSAML","description":"The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.","status":"published","published":"2022-05-13T01:04:00Z","modified":"2023-01-27T05:02:29Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:18.427692Z"}],"nvd":[{"id":"CVE-2013-6440","description":"The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.","status":"published","published":"2014-02-14T15:55:05.11Z","modified":"2026-06-17T00:00:29.87Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"GHSA-v723-58jv-2qc4","title":"Exposure of Sensitive Information to an Unauthorized Actor in OpenSAML","description":"The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.","status":"published","published":"2022-05-13T01:04:00Z","modified":"2024-12-05T05:43:44.128655Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"RHSA-2014:0170","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 update","status":"published","published":"2024-09-29T16:45:50Z","modified":"2026-08-05T10:02:24Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:0171","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 update","status":"published","published":"2024-09-29T16:45:56Z","modified":"2026-08-05T10:02:24Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}