{"id":"CVE-2017-16852","aliases":["DEBIAN-CVE-2017-16852","DLA-1179-1","DSA-4038-1","EUVD-2017-8026","GHSA-5rhm-55rh-pvvp","SUSE-SU-2017:3215-1","UBUNTU-CVE-2017-16852","openSUSE-SU-2024:11381-1"],"status":"published","title":"shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth...","description":"shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01105,"percentile":0.66,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2017-11-16T00:00:00Z","modified":"2026-06-17T01:10:01Z","fixes":[{"ecosystem":"Debian:7","package":"shibboleth-sp2","fixed_in":["2.4.3+dfsg-5+deb7u2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"shibboleth-sp2","fixed_in":["2.5.3+dfsg-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"shibboleth-sp2","fixed_in":["2.6.0+dfsg1-4+deb9u1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"shibboleth-sp","fixed_in":["2.5.5-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"shibboleth-sp","fixed_in":["2.5.5-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"shibboleth-sp","fixed_in":["2.5.5-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"shibboleth-sp","fixed_in":["2.5.5-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"shibboleth-sp","fixed_in":["2.5.5-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"shibboleth-sp","fixed_in":["2.5.5-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"shibboleth-sp","fixed_in":["2.5.5-6.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"shibboleth-sp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3+dfsg-5+deb7u2"}]}],"versions":["2.4.3+dfsg-5","2.4.3+dfsg-5+deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"shibboleth-sp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.3+dfsg-2+deb8u1"}]}],"versions":["2.5.3+dfsg-2"]},{"source":"osv","ecosystem":"Debian:9","package":"shibboleth-sp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0+dfsg1-4+deb9u1"}]}],"versions":["2.6.0+dfsg1-4","2.6.0+dfsg1-4+deb9u1~bpo8+1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-6.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"shibboleth-sp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.3+dfsg-2.1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sha1collisiondetection","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1.2"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"shibboleth","product":"service_provider"}],"references":[{"url":"https://bugs.debian.org/881857","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=b66cceb0e992c351ad5e2c665229ede82f261b16","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://shibboleth.net/community/advisories/secadv_20171115.txt","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00025.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2017/dsa-4038","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16852"},{"url":"https://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=b66cceb0e992c351ad5e2c665229ede82f261b16","tags":["report"]},{"url":"https://github.com/advisories/GHSA-5rhm-55rh-pvvp"},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173215-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1068689","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16852","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-16852","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16852","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19191","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-16852","description":"shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.","status":"published","published":"2017-11-16T17:00:00Z","modified":"2024-08-05T20:35:21.217Z","updated_at":"2026-11-02T14:33:21.453505Z"}],"euvd":[{"id":"EUVD-2017-8026","description":"shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.","status":"published","published":"2017-11-16T17:00:00Z","modified":"2024-08-05T20:35:21Z","updated_at":"2026-11-03T02:23:11.533108Z"}],"ghsa":[{"id":"GHSA-5rhm-55rh-pvvp","title":"shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth...","description":"shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.","status":"published","published":"2022-05-14T03:46:33Z","modified":"2025-04-20T03:49:36Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:01:56.152144Z"}],"nvd":[{"id":"CVE-2017-16852","description":"shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.","status":"published","published":"2017-11-16T17:29:00.45Z","modified":"2026-06-17T01:10:01.55Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:04:08.635428Z"}],"osv":[{"id":"UBUNTU-CVE-2017-16852","description":"shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.","status":"published","published":"2017-11-16T17:29:00Z","modified":"2026-04-22T11:19:25.316598Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"DLA-1179-1","title":"shibboleth-sp2 - security update","status":"published","published":"2017-11-18T00:00:00Z","modified":"2026-03-09T01:01:03.845259Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4038-1","title":"shibboleth-sp2 - security update","status":"published","published":"2017-11-16T00:00:00Z","modified":"2026-03-09T01:21:11.191266Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"openSUSE-SU-2024:11381-1","title":"libshibsp-lite10-3.2.3-1.2 on GA media","description":"These are all security issues fixed in the libshibsp-lite10-3.2.3-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:04.191416Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:3215-1","title":"Security update for shibboleth-sp","description":"This update for shibboleth-sp fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-16852: Fix critical security checks in the Dynamic MetadataProvider plugin in Shibboleth Service (bsc#1068689).\n","status":"published","published":"2017-12-05T16:39:46Z","modified":"2026-02-04T02:49:55.748407Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}