UBUNTU-CVE-2017-16852
- Source
- https://ubuntu.com/security/CVE-2017-16852
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-16852.json
- JSON Data
- https://api.osv.dev/v1/vulns/UBUNTU-CVE-2017-16852
- Upstream
- Published
- 2017-11-16T17:29:00Z
- Modified
- 2025-10-24T04:46:36Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Ubuntu - medium
- Summary
- [none]
- Details
-
shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.
- References
Affected packages
Ubuntu:16.04:LTS / shibboleth-sp2
Package
- Name
- shibboleth-sp2
- Purl
- pkg:deb/ubuntu/shibboleth-sp2@2.5.3+dfsg-2.1build1?arch=source&distro=xenial
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Ecosystem specific
{
"binaries": [
{
"binary_version": "2.5.3+dfsg-2.1build1",
"binary_name": "libapache2-mod-shib2"
},
{
"binary_version": "2.5.3+dfsg-2.1build1",
"binary_name": "libshibsp-dev"
},
{
"binary_version": "2.5.3+dfsg-2.1build1",
"binary_name": "libshibsp-plugins"
},
{
"binary_version": "2.5.3+dfsg-2.1build1",
"binary_name": "libshibsp6"
},
{
"binary_version": "2.5.3+dfsg-2.1build1",
"binary_name": "shibboleth-sp2-common"
},
{
"binary_version": "2.5.3+dfsg-2.1build1",
"binary_name": "shibboleth-sp2-schemas"
},
{
"binary_version": "2.5.3+dfsg-2.1build1",
"binary_name": "shibboleth-sp2-utils"
}
]
}