Bug 1068689 – VUL-0: CVE-2017-16852: shibboleth-sp: shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProviderplugin fails to properly configure the MetadataFilter plugins, skipping verifications

Bug 1068689 - (CVE-2017-16852) VUL-0: CVE-2017-16852: shibboleth-sp: shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProviderplugin fails to properly configure the MetadataFilter plugins, skipping verifications

(CVE-2017-16852)
Summary:	VUL-0: CVE-2017-16852: shibboleth-sp: shibsp/metadata/DynamicMetadataProvider...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Major
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/195134/
Whiteboard:	CVSSv2:SUSE:CVE-2017-16852:7.1:(AV:N/...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2017-11-17 12:30 UTC by Johannes Segitz
Modified:	2017-12-07 02:06 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Johannes Segitz 2017-11-17 12:30:17 UTC

CVE-2017-16852

shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider
plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure
itself with the MetadataFilter plugins and does not perform critical security
checks such as signature verification, enforcement of validity periods, and
other checks specific to deployments, aka SSPCPP-763.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16852
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16852.html
http://www.debian.org/security/2017/dsa-4038
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881857
https://shibboleth.net/community/advisories/secadv_20171115.txt
https://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=b66cceb0e992c351ad5e2c665229ede82f261b16

Comment 1 Kristyna Streitova 2017-11-21 12:21:09 UTC

Done.

|    Codestream    |   Request    |
|------------------|--------------|
| SLE12SP1         | #146767      |
| openSUSE:Leap    | via SLE12SP1 |
| openSUSE:Factory | #544153      |

I'm reassigning it back to the security-team.

Comment 3 Swamp Workflow Management 2017-12-05 20:11:15 UTC

SUSE-SU-2017:3215-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1068689
CVE References: CVE-2017-16852
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    shibboleth-sp-2.5.5-6.3.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    shibboleth-sp-2.5.5-6.3.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    shibboleth-sp-2.5.5-6.3.1
SUSE Linux Enterprise Server 12-SP3 (src):    shibboleth-sp-2.5.5-6.3.1
SUSE Linux Enterprise Server 12-SP2 (src):    shibboleth-sp-2.5.5-6.3.1

Comment 4 Andreas Stieger 2017-12-06 21:36:10 UTC

done

Comment 5 Swamp Workflow Management 2017-12-07 02:06:59 UTC

openSUSE-SU-2017:3229-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1068689
CVE References: CVE-2017-16852
Sources used:
openSUSE Leap 42.3 (src):    shibboleth-sp-2.5.5-9.2
openSUSE Leap 42.2 (src):    shibboleth-sp-2.5.5-6.3.1