CVE-2017-16852

Description

shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.

References

https://www.debian.org/security/2017/dsa-4038

https://shibboleth.net/community/advisories/secadv_20171115.txt

https://lists.debian.org/debian-lts-announce/2017/11/msg00025.html

https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=b66cceb0e992c351ad5e2c665229ede82f261b16

https://bugs.debian.org/881857

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3