We are using opensaml 2.6.1 , xmltooling 1.4.1 and spring-security-saml2-core-1.0.0. java libraries.
Wanted to check if the recent vulnerability detected in SAML implemenation VU#475445 will be applicable for these libraries.
If so how we can resolve it.
If you are running with the defaults, then you are not affected. The key is the property ignoreComments on the ParserPool bean which by default is set to "true". You can read more on this thread: https://github.com/spring-projects/spring-security-saml/issues/228