PT-2017-14598 · Shibboleth Consortium+1 · Opensaml+1

Rod Widdowson · Published 2017-11-16 · Updated 2018-02-04 · CVE-2017-16853

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSAML versions prior to 2.6.1

Description The issue arises from the DynamicMetadataProvider class in OpenSAML-C, which fails to properly configure itself with the MetadataFilter plugins. This failure leads to a lack of critical security checks, including signature verification and enforcement of validity periods. These checks are crucial for secure deployments.

Recommendations For versions prior to 2.6.1, update to version 2.6.1 or later to resolve the issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2017-16853

DLA-1178-1

DSA-4039-1

OPENSUSE-SU-2017_3241-1

OPENSUSE-SU-2024:11122-1

SUSE-SU-2017:3234-1

SUSE-SU-2017_3234-1

Affected Products

Opensaml

Suse

References · 17

• https://osv.dev/vulnerability/CVE-2017-16853 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-16853 · Security Note
• https://ubuntu.com/security/CVE-2017-16853 · Vendor Advisory
• https://shibboleth.net/community/advisories/secadv_20171115.txt · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4039-1 · Vendor Advisory
• https://debian.org/security/2017/dsa-4039 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:3234-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16853 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16853 · Vendor Advisory
• http://securityfocus.com/bid/101898 · Note
• https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d · Note
• https://suse.com/support/update/announcement/2017/suse-su-20173234-1 · Note
• https://bugs.debian.org/881856 · Note
• https://suse.com/security/cve/CVE-2017-16853 · Note
• https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html · Note