CVEvulnerability
CVE-2017-16852
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-11-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-347
Description
shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.
Affected configurations
• shibboleth service provider (< 2.6.1)
• debian debian linux 8.0
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-347 Improper Verification of Cryptographic Signature weakness
References
- https://bugs.debian.org/881857 Issue Tracking, Third Party Advisory
- https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=b66cceb0e992c351ad5e2c665229ede82f261b16 git.shibboleth.net
- https://lists.debian.org/debian-lts-announce/2017/11/msg00025.html lists.debian.org
- https://shibboleth.net/community/advisories/secadv_20171115.txt Issue Tracking, Vendor Advisory
- https://www.debian.org/security/2017/dsa-4038 Issue Tracking, Third Party Advisory
- https://bugs.debian.org/881857 Issue Tracking, Third Party Advisory
- https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=b66cceb0e992c351ad5e2c665229ede82f261b16 git.shibboleth.net
- https://lists.debian.org/debian-lts-announce/2017/11/msg00025.html lists.debian.org
- https://shibboleth.net/community/advisories/secadv_20171115.txt Issue Tracking, Vendor Advisory
- https://www.debian.org/security/2017/dsa-4038 Issue Tracking, Third Party Advisory