CVE-2019-9628

Name: CVE-2019-9628
Creator: NVD / NIST
Published: 2019-04-11T20:29:00.837+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 2.05%

Last modified Jun 17, 2026

CVE-2019-9628 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.. EPSS estimates a 2.05% chance of exploitation in the next 30 days.

Description

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

2.05%

78.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-755

Affected Software

Vendor	Product	Versions
Xmltooling Project	Xmltooling	< 3.0.4
Canonical	Ubuntu Linux	14.04
Canonical	Ubuntu Linux	16.04
Canonical	Ubuntu Linux	18.04
Canonical	Ubuntu Linux	18.10
Opensuse	Leap	15.0
Opensuse	Leap	42.3

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.htmlMailing List, Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912Issue Tracking, Third Party Advisory
https://security.netapp.com/advisory/ntap-20190611-0003/Third Party Advisory
https://shibboleth.net/community/advisories/secadv_20190311.txtThird Party Advisory
https://usn.ubuntu.com/3921-1/Third Party Advisory
https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisoriesThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.htmlMailing List, Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912Issue Tracking, Third Party Advisory
https://security.netapp.com/advisory/ntap-20190611-0003/Third Party Advisory
https://shibboleth.net/community/advisories/secadv_20190311.txtThird Party Advisory
https://usn.ubuntu.com/3921-1/Third Party Advisory
https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisoriesThird Party Advisory

Timeline

Published: Apr 11, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-9628?

How severe is CVE-2019-9628?

CVE-2019-9628 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 2.05% probability of exploitation in the next 30 days.

How do I fix CVE-2019-9628?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-9628?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST