PT-2017-14597 · Shibboleth+1 · Shibboleth Service Provider+1

Rod Widdowson · Published 2017-11-16 · Updated 2024-06-15 · CVE-2017-16852

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shibboleth Service Provider versions prior to 2.6.1

Description The issue arises from the Dynamic MetadataProvider plugin in Shibboleth Service Provider, which fails to properly configure itself with the MetadataFilter plugins. This failure leads to the omission of critical security checks, including signature verification and enforcement of validity periods, among other deployment-specific checks.

Recommendations For versions prior to 2.6.1, update to version 2.6.1 or later to resolve the issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2017-16852

DLA-1179-1

DSA-4038-1

OPENSUSE-SU-2017_3229-1

OPENSUSE-SU-2024:11381-1

SUSE-SU-2017:3215-1

SUSE-SU-2017_3215-1

Affected Products

Shibboleth Service Provider

Suse

References · 18

• https://osv.dev/vulnerability/SUSE-SU-2017:3215-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16852 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11381-1 · Vendor Advisory
• https://debian.org/security/2017/dsa-4038 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-16852 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16852 · Vendor Advisory
• https://shibboleth.net/community/advisories/secadv_20171115.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16852 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4038-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16852 · Vendor Advisory
• https://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=b66cceb0e992c351ad5e2c665229ede82f261b16 · Note
• https://suse.com/security/cve/CVE-2019-19191 · Note
• https://lists.debian.org/debian-lts-announce/2017/11/msg00025.html · Note
• https://bugzilla.suse.com/1068689 · Note
• https://suse.com/support/update/announcement/2017/suse-su-20173215-1 · Note