CVEvulnerability
CVE-2017-16853
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-11-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-347
Description
The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.
Affected configurations
• shibboleth opensaml (< 2.6.1)
• debian debian linux 8.0
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-347 Improper Verification of Cryptographic Signature weakness
References
- http://www.securityfocus.com/bid/101898 Third Party Advisory, VDB Entry
- https://bugs.debian.org/881856 Issue Tracking, Third Party Advisory
- https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d git.shibboleth.net
- https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html lists.debian.org
- https://shibboleth.net/community/advisories/secadv_20171115.txt Issue Tracking, Vendor Advisory
- https://www.debian.org/security/2017/dsa-4039 Issue Tracking, Third Party Advisory
- http://www.securityfocus.com/bid/101898 Third Party Advisory, VDB Entry
- https://bugs.debian.org/881856 Issue Tracking, Third Party Advisory
- https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d git.shibboleth.net
- https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html lists.debian.org
- https://shibboleth.net/community/advisories/secadv_20171115.txt Issue Tracking, Vendor Advisory
- https://www.debian.org/security/2017/dsa-4039 Issue Tracking, Third Party Advisory