Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-16853

The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.

Published

2017-11-16T17:29:00.497

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.6

Impact Score

6.4

Weaknesses

Type: Primary
CWE-347

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	shibboleth	opensaml	< 2.6.1	Yes
Operating System	debian	debian_linux	8.0	Yes
Operating System	debian	debian_linux	9.0	Yes

References

http://www.securityfocus.com/bid/101898 Third Party Advisory, VDB Entry ([email protected])
https://bugs.debian.org/881856 Issue Tracking, Third Party Advisory ([email protected])
https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d ([email protected])
https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html ([email protected])
https://shibboleth.net/community/advisories/secadv_20171115.txt Issue Tracking, Vendor Advisory ([email protected])
https://www.debian.org/security/2017/dsa-4039 Issue Tracking, Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/101898 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://bugs.debian.org/881856 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html (af854a3a-2127-422b-91ae-364da2661108)
https://shibboleth.net/community/advisories/secadv_20171115.txt Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2017/dsa-4039 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)