The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.

This update for opensaml fixes the following issues :

Security issue fixed :

  - CVE-2017-16853: Fix the DynamicMetadataProvider class to     properly configure itself with the MetadataFilter     plugins, to avoid possible MITM attacks (bsc#1068685).

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for opensaml fixes the following issues: Security issue fixed :

  - CVE-2017-16853: Fix the DynamicMetadataProvider class to     properly configure itself with the MetadataFilter     plugins, to avoid possible MITM attacks (bsc#1068685).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Rod Widdowson of Steading System Software LLP discovered a coding error in the OpenSAML library, causing the DynamicMetadataProvider class to fail configuring itself with the filters provided and omitting whatever checks they are intended to perform.

For Debian 7 'Wheezy', these problems have been fixed in version 2.4.3-4+deb7u2.

We recommend that you upgrade your opensaml2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Rod Widdowson of Steading System Software LLP discovered a coding error in the OpenSAML library, causing the DynamicMetadataProvider class to fail configuring itself with the filters provided and omitting whatever checks they are intended to perform.

See https://shibboleth.net/community/advisories/secadv_20171115.txt for details.

ID	Name	Product	Family	Severity
105236	openSUSE Security Update : opensaml (openSUSE-2017-1350)	Nessus	SuSE Local Security Checks	high
105097	SUSE SLES12 Security Update : opensaml (SUSE-SU-2017:3234-1)	Nessus	SuSE Local Security Checks	high
104681	Debian DLA-1178-1 : opensaml2 security update	Nessus	Debian Local Security Checks	high
104645	Debian DSA-4039-1 : opensaml2 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-16853

high

Tenable Plugins

high

high

high

high