PT-2017-14598 · Shibboleth Consortium+1 · Opensaml+1

Rod Widdowson · Publicado 2017-11-16 · Atualizado 2018-02-04 · CVE-2017-16853

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSAML versions prior to 2.6.1

Description The issue arises from the DynamicMetadataProvider class in OpenSAML-C, which fails to properly configure itself with the MetadataFilter plugins. This failure leads to a lack of critical security checks, including signature verification and enforcement of validity periods. These checks are crucial for secure deployments.

Recommendations For versions prior to 2.6.1, update to version 2.6.1 or later to resolve the issue.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2017-16853

DLA-1178-1

DSA-4039-1

OPENSUSE-SU-2017_3241-1

OPENSUSE-SU-2024:11122-1

SUSE-SU-2017:3234-1

SUSE-SU-2017_3234-1

Produtos afetados

Opensaml

Suse

Referências · 17

• http://securityfocus.com/bid/101898 · Nota
• https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d · Nota
• https://suse.com/support/update/announcement/2017/suse-su-20173234-1 · Nota
• https://osv.dev/vulnerability/CVE-2017-16853 · Aviso do Fabricante
• https://bugs.debian.org/881856 · Nota
• https://suse.com/security/cve/CVE-2017-16853 · Nota
• https://cve.org/CVERecord?id=CVE-2017-16853 · Nota de Segurança
• https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html · Nota
• https://bugzilla.suse.com/1068685 · Nota
• https://ubuntu.com/security/CVE-2017-16853 · Aviso do Fabricante
• https://shibboleth.net/community/advisories/secadv_20171115.txt · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4039-1 · Aviso do Fabricante
• https://debian.org/security/2017/dsa-4039 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2017:3234-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16853 · Nota de Segurança