PT-2017-14597 · Shibboleth+1 · Shibboleth Service Provider+1

Rod Widdowson · Publicado 2017-11-16 · Atualizado 2024-06-15 · CVE-2017-16852

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shibboleth Service Provider versions prior to 2.6.1

Description The issue arises from the Dynamic MetadataProvider plugin in Shibboleth Service Provider, which fails to properly configure itself with the MetadataFilter plugins. This failure leads to the omission of critical security checks, including signature verification and enforcement of validity periods, among other deployment-specific checks.

Recommendations For versions prior to 2.6.1, update to version 2.6.1 or later to resolve the issue.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2017-16852

DLA-1179-1

DSA-4038-1

OPENSUSE-SU-2017_3229-1

OPENSUSE-SU-2024:11381-1

SUSE-SU-2017:3215-1

SUSE-SU-2017_3215-1

Produtos afetados

Shibboleth Service Provider

Suse

Referências · 18

• https://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=b66cceb0e992c351ad5e2c665229ede82f261b16 · Nota
• https://suse.com/security/cve/CVE-2019-19191 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2017:3215-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16852 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:11381-1 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2017/11/msg00025.html · Nota
• https://debian.org/security/2017/dsa-4038 · Aviso do Fabricante
• https://bugzilla.suse.com/1068689 · Nota
• https://suse.com/support/update/announcement/2017/suse-su-20173215-1 · Nota
• https://bugs.debian.org/881857 · Nota
• https://cve.org/CVERecord?id=CVE-2017-16852 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16852 · Aviso do Fabricante
• https://shibboleth.net/community/advisories/secadv_20171115.txt · Aviso do Fabricante
• https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=b66cceb0e992c351ad5e2c665229ede82f261b16 · Nota
• https://osv.dev/vulnerability/CVE-2017-16852 · Aviso do Fabricante