{"id":"CVE-2017-16853","aliases":["DEBIAN-CVE-2017-16853","DLA-1178-1","DSA-4039-1","EUVD-2017-8027","GHSA-hrv7-jmr6-cr43","SUSE-SU-2017:3234-1","UBUNTU-CVE-2017-16853","openSUSE-SU-2024:11122-1"],"status":"published","title":"The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in...","description":"The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01398,"percentile":0.72636,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2017-11-16T00:00:00Z","modified":"2026-06-17T01:10:01Z","fixes":[{"ecosystem":"Debian:7","package":"opensaml2","fixed_in":["2.4.3-4+deb7u2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"opensaml2","fixed_in":["2.5.3-2+deb8u2"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"opensaml2","fixed_in":["2.6.0-4+deb9u1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"opensaml","fixed_in":["2.5.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"opensaml","fixed_in":["2.5.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"opensaml","fixed_in":["2.5.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"opensaml","fixed_in":["2.5.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"opensaml","fixed_in":["2.5.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"opensaml","fixed_in":["2.5.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"opensaml","fixed_in":["2.5.5-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"opensaml2","fixed_in":["2.5.3-2+deb8u2build0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"opensaml2","fixed_in":["2.5.5-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"opensaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-4+deb7u2"}]}],"versions":["2.4.3-4","2.4.3-4+deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"opensaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.3-2+deb8u2"}]}],"versions":["2.5.3-2","2.5.3-2+deb8u1"]},{"source":"osv","ecosystem":"Debian:9","package":"opensaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-4+deb9u1"}]}],"versions":["2.6.0-4","2.6.0-4+deb9u1~bpo8+1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"opensaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"opensaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"opensaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"opensaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"opensaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"opensaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"opensaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"opensaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.3-2+deb8u2build0.14.04.1"}]}],"versions":["2.5.3-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"opensaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-1ubuntu0.1"}]}],"versions":["2.5.3-2.1ubuntu2","2.5.5-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"shibboleth","product":"opensaml"}],"references":[{"url":"https://www.debian.org/security/2017/dsa-4039","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://bugs.debian.org/881856","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://www.securityfocus.com/bid/101898","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://shibboleth.net/community/advisories/secadv_20171115.txt","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16853"},{"url":"https://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=6182b0acf2df670e75423c2ed7afe6950ef11c9d","tags":["report"]},{"url":"https://github.com/advisories/GHSA-hrv7-jmr6-cr43"},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173234-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1068685","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16853","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-16853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16853","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-16853","description":"The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.","status":"published","published":"2017-11-16T17:00:00Z","modified":"2024-08-05T20:35:21.236Z","updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2017-8027","description":"The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.","status":"published","published":"2017-11-16T17:00:00Z","modified":"2024-08-05T20:35:21Z","updated_at":"2026-11-03T02:23:11.533108Z"}],"ghsa":[{"id":"GHSA-hrv7-jmr6-cr43","title":"The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in...","description":"The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.","status":"published","published":"2022-05-14T03:46:33Z","modified":"2025-04-20T03:49:36Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:01:56.152144Z"}],"nvd":[{"id":"CVE-2017-16853","description":"The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.","status":"published","published":"2017-11-16T17:29:00.497Z","modified":"2026-06-17T01:10:01.67Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:04:08.635428Z"}],"osv":[{"id":"UBUNTU-CVE-2017-16853","description":"The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.","status":"published","published":"2017-11-16T17:29:00Z","modified":"2026-04-22T11:14:59.582871Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"DLA-1178-1","title":"opensaml2 - security update","status":"published","published":"2017-11-18T00:00:00Z","modified":"2026-03-09T01:01:18.144703Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4039-1","title":"opensaml2 - security update","status":"published","published":"2017-11-16T00:00:00Z","modified":"2026-03-09T01:19:01.922034Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"openSUSE-SU-2024:11122-1","title":"libsaml-devel-3.2.0-1.2 on GA media","description":"These are all security issues fixed in the libsaml-devel-3.2.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:41.316618Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2017:3234-1","title":"Security update for opensaml","description":"This update for opensaml fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-16853: Fix the DynamicMetadataProvider class to properly configure itself with the MetadataFilter plugins, to avoid possible MITM attacks (bsc#1068685).\n","status":"published","published":"2017-12-07T14:28:33Z","modified":"2026-02-04T03:14:33.804225Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}