Skip to content
OpenAdvisories
Unscored CVE-2017-16853 EUVD-2017-8027GHSA-hrv7-jmr6-cr43

The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to p…

Published Nov 16, 2017 · Updated Aug 5, 2024 · Assigned by mitre

Package: opensaml2 Ecosystem: Ubuntu

Description

The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 9 opensaml2 2.6.0-4+deb9u1 DSA-4039-1
Debian 8 opensaml2 2.5.3-2+deb8u2 DSA-4039-1
Debian 7 opensaml2 2.4.3-4+deb7u2 DLA-1178-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS opensaml2 2.5.5-1ubuntu0.1 —
Ubuntu 14.04 LTS opensaml2 2.5.3-2+deb8u2build0.14.04.1 —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP3 opensaml 2.5.5-3.3.1 SUSE-SU-2017:3234-1
SLES 12 SP2 opensaml 2.5.5-3.3.1 SUSE-SU-2017:3234-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP3 opensaml 2.5.5-3.3.1 SUSE-SU-2017:3234-1
SLES for SAP 12 SP2 opensaml 2.5.5-3.3.1 SUSE-SU-2017:3234-1

Advisories 3

References