CVE catalog

CVE-2017-16853

Security update for opensaml

[CVE catalog]

Severity
High · CVSS 7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.40% · Oct 27, 2026

The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntuopensaml214.042.5.3-2vulnerable
Ubuntuopensaml214.042.5.3-2+deb8u2build0.14.04.1fixed
Ubuntuopensaml216.042.5.3-2.1ubuntu2vulnerable
Ubuntuopensaml216.042.5.5-1vulnerable
Ubuntuopensaml216.042.5.5-1ubuntu0.1fixed
Debianopensaml282.5.3-2vulnerable
Debianopensaml282.5.3-2+deb8u1vulnerable
Debianopensaml282.5.3-2+deb8u2fixed
Debianopensaml292.6.0-4vulnerable
Debianopensaml292.6.0-4+deb9u1~bpo8+1vulnerable
Debianopensaml292.6.0-4+deb9u1fixed
Debianopensaml272.4.3-4vulnerable
Debianopensaml272.4.3-4+deb7u1vulnerable
Debianopensaml272.4.3-4+deb7u2fixed
Suseopensamllinux enterprise server for raspberry pi 12 sp22.5.5-3.3.1fixed
Suseopensamllinux enterprise software development kit 12 sp22.5.5-3.3.1fixed
Suseopensamllinux enterprise software development kit 12 sp32.5.5-3.3.1fixed
Suseopensamllinux enterprise server 12 sp22.5.5-3.3.1fixed
Suseopensamllinux enterprise server for sap applications 12 sp22.5.5-3.3.1fixed
Suseopensamllinux enterprise server 12 sp32.5.5-3.3.1fixed
Suseopensamllinux enterprise server for sap applications 12 sp32.5.5-3.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntuopensaml2deb14.042.5.3-2+deb8u2build0.14.04.1Not reportedUBUNTU-CVE-2017-16853Not reported
Ubuntuopensaml2deb16.042.5.5-1ubuntu0.1Not reportedUBUNTU-CVE-2017-16853Not reported
Debianopensaml2deb82.5.3-2+deb8u2Not reportedDSA-4039-1Not reported
Debianopensaml2deb92.6.0-4+deb9u1Not reportedDSA-4039-1Not reported
Debianopensaml2deb72.4.3-4+deb7u2Not reportedDLA-1178-1Not reported
Suseopensamlrpmlinux enterprise server for raspberry pi 12 sp22.5.5-3.3.1Not reportedSUSE-SU-2017:3234-1Not reported
Suseopensamlrpmlinux enterprise software development kit 12 sp22.5.5-3.3.1Not reportedSUSE-SU-2017:3234-1Not reported
Suseopensamlrpmlinux enterprise software development kit 12 sp32.5.5-3.3.1Not reportedSUSE-SU-2017:3234-1Not reported
Suseopensamlrpmlinux enterprise server 12 sp22.5.5-3.3.1Not reportedSUSE-SU-2017:3234-1Not reported
Suseopensamlrpmlinux enterprise server for sap applications 12 sp22.5.5-3.3.1Not reportedSUSE-SU-2017:3234-1Not reported
Suseopensamlrpmlinux enterprise server 12 sp32.5.5-3.3.1Not reportedSUSE-SU-2017:3234-1Not reported
Suseopensamlrpmlinux enterprise server for sap applications 12 sp32.5.5-3.3.1Not reportedSUSE-SU-2017:3234-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]