CVE catalog

CVE-2017-16852

libshibsp-lite10-3.2.3-1.2 on GA media

[CVE catalog]

Severity
High · CVSS 7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.10% · Oct 25, 2026

shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntushibboleth-sp216.042.5.3+dfsg-2.1build1vulnerable
Debianshibboleth-sp282.5.3+dfsg-2vulnerable
Debianshibboleth-sp282.5.3+dfsg-2+deb8u1fixed
Debianshibboleth-sp292.6.0+dfsg1-4vulnerable
Debianshibboleth-sp292.6.0+dfsg1-4+deb9u1~bpo8+1vulnerable
Debianshibboleth-sp292.6.0+dfsg1-4+deb9u1fixed
Debianshibboleth-sp272.4.3+dfsg-5vulnerable
Debianshibboleth-sp272.4.3+dfsg-5+deb7u1vulnerable
Debianshibboleth-sp272.4.3+dfsg-5+deb7u2fixed
Suseshibboleth-splinux enterprise server for raspberry pi 12 sp22.5.5-6.3.1fixed
Suseshibboleth-splinux enterprise software development kit 12 sp22.5.5-6.3.1fixed
Suseshibboleth-splinux enterprise software development kit 12 sp32.5.5-6.3.1fixed
Suseshibboleth-splinux enterprise server 12 sp22.5.5-6.3.1fixed
Suseshibboleth-splinux enterprise server for sap applications 12 sp22.5.5-6.3.1fixed
Suseshibboleth-splinux enterprise server 12 sp32.5.5-6.3.1fixed
Suseshibboleth-splinux enterprise server for sap applications 12 sp32.5.5-6.3.1fixed
Opensusesha1collisiondetectiontumbleweed3.2.3-1.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianshibboleth-sp2deb82.5.3+dfsg-2+deb8u1Not reportedDSA-4038-1Not reported
Debianshibboleth-sp2deb92.6.0+dfsg1-4+deb9u1Not reportedDSA-4038-1Not reported
Debianshibboleth-sp2deb72.4.3+dfsg-5+deb7u2Not reportedDLA-1179-1Not reported
Suseshibboleth-sprpmlinux enterprise server for raspberry pi 12 sp22.5.5-6.3.1Not reportedSUSE-SU-2017:3215-1Not reported
Suseshibboleth-sprpmlinux enterprise software development kit 12 sp22.5.5-6.3.1Not reportedSUSE-SU-2017:3215-1Not reported
Suseshibboleth-sprpmlinux enterprise software development kit 12 sp32.5.5-6.3.1Not reportedSUSE-SU-2017:3215-1Not reported
Suseshibboleth-sprpmlinux enterprise server 12 sp22.5.5-6.3.1Not reportedSUSE-SU-2017:3215-1Not reported
Suseshibboleth-sprpmlinux enterprise server for sap applications 12 sp22.5.5-6.3.1Not reportedSUSE-SU-2017:3215-1Not reported
Suseshibboleth-sprpmlinux enterprise server 12 sp32.5.5-6.3.1Not reportedSUSE-SU-2017:3215-1Not reported
Suseshibboleth-sprpmlinux enterprise server for sap applications 12 sp32.5.5-6.3.1Not reportedSUSE-SU-2017:3215-1Not reported
Opensusesha1collisiondetectionrpmtumbleweed3.2.3-1.2Not reportedOPENSUSE-SU-2024:11381-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[openSUSE Tumbleweed]

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]