CVE-2017-16853

EUVD-2017-8027
The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
Affected Products (NVD)
VendorProductVersion
shibbolethopensaml
𝑥
< 2.6.1
debiandebian_linux
8.0
debiandebian_linux
9.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
opensaml2
artful
Fixed 2.6.0-4+deb9u1build0.17.10.1
released
bionic
not-affected
cosmic
not-affected
trusty
Fixed 2.5.3-2+deb8u2build0.14.04.1
released
xenial
Fixed 2.5.5-1ubuntu0.1
released
zesty
Fixed 2.6.0-4+deb9u1build0.17.04.1
released
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/101898
https://bugs.debian.org/881856
https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d
https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html
https://shibboleth.net/community/advisories/secadv_20171115.txt
https://www.debian.org/security/2017/dsa-4039
http://www.securityfocus.com/bid/101898
https://bugs.debian.org/881856
https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d
https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html
https://shibboleth.net/community/advisories/secadv_20171115.txt
https://www.debian.org/security/2017/dsa-4039