{"id":"CVE-2025-9943","aliases":["DEBIAN-CVE-2025-9943","DLA-4300-1","DSA-5994-1","EUVD-2025-27518","GHSA-p7fp-v35q-pm7j","SUSE-SU-2026:22854-1","SUSE-SU-2026:3098-1","SUSE-SU-2026:3123-1","UBUNTU-CVE-2025-9943","USN-8768-1","openSUSE-SU-2025:15714-1","openSUSE-SU-2026:21418-1"],"status":"published","title":"Unauthenticated SQL Injection Vulnerability in Shibboleth Service Provider","description":"An SQL injection vulnerability has been identified in the \"ID\" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).\n\nThis issue affects Shibboleth Service Provider through 3.5.0.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00412,"percentile":0.35753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2025-09-07T00:00:00Z","modified":"2026-09-26T08:47:39Z","fixes":[{"ecosystem":"Debian:12","package":"shibboleth-sp","fixed_in":["3.4.1+dfsg-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"shibboleth-sp","fixed_in":["3.5.0+dfsg-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"shibboleth-sp","fixed_in":["3.5.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"shibboleth-sp","fixed_in":["3.2.2+dfsg1-1+deb11u1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"shibboleth-sp","fixed_in":["3.5.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"shibboleth-sp","fixed_in":["3.5.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"shibboleth-sp","fixed_in":["2.5.5-6.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"shibboleth-sp","fixed_in":["2.5.5-6.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"shibboleth-sp","fixed_in":["3.1.0-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"shibboleth-sp","fixed_in":["3.1.0-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"shibboleth-sp","fixed_in":["3.1.0-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"shibboleth-sp","fixed_in":["3.1.0-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"shibboleth-sp","fixed_in":["3.1.0-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"shibboleth-sp","fixed_in":["3.1.0-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"shibboleth-sp","fixed_in":["3.1.0-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"shibboleth-sp","fixed_in":["3.1.0-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"shibboleth-sp","fixed_in":["3.1.0-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"shibboleth-sp","fixed_in":["3.1.0-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"shibboleth-sp","fixed_in":["3.1.0-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"shibboleth-sp","fixed_in":["3.0.4+dfsg1-1ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"shibboleth-sp","fixed_in":["3.3.0+dfsg1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"shibboleth-sp","fixed_in":["3.4.1+dfsg-2.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"shibboleth-sp","fixed_in":["3.5.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"shibboleth-sp","fixed_in":["3.5.0-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-2+deb12u1"}]}],"versions":["3.4.1+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0+dfsg-2+deb13u1"}]}],"versions":["3.5.0+dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1+dfsg-1"}]}],"versions":["3.5.0+dfsg-2"]},{"source":"osv","ecosystem":"Debian:11","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2+dfsg1-1+deb11u1"}]}],"versions":["3.2.2+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:12","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-2+deb12u1"}]}],"versions":["3.4.1+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0+dfsg-2+deb13u1"}]}],"versions":["3.5.0+dfsg-2"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-6.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-6.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4+dfsg1-1ubuntu0.2+esm1"}]}],"versions":["3.0.4+dfsg1-1","3.0.4+dfsg1-1build1","3.0.4+dfsg1-1ubuntu0.1","3.0.4+dfsg1-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["3.2.2+dfsg1-1ubuntu1","3.3.0+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-2.1ubuntu0.1~esm1"}]}],"versions":["3.4.1+dfsg-2","3.4.1+dfsg-2.1","3.4.1+dfsg-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.0+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4+dfsg1-1ubuntu0.2+esm1"}]}],"versions":["3.0.4+dfsg1-1","3.0.4+dfsg1-1build1","3.0.4+dfsg1-1ubuntu0.1","3.0.4+dfsg1-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["3.2.2+dfsg1-1ubuntu1","3.3.0+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-2.1ubuntu0.1~esm1"}]}],"versions":["3.4.1+dfsg-2","3.4.1+dfsg-2.1","3.4.1+dfsg-2.1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"shibboleth-sp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.3.1"}]}]}],"products":[{"vendor":"shibboleth","product":"service provider"}],"references":[{"url":"https://shibboleth.net/community/advisories/secadv_20250903.txt","tags":["vendor-advisory","advisory","report"]},{"url":"https://r.sec-consult.com/shibboleth","tags":["third-party-advisory","web","report"]},{"url":"https://shibboleth.net/downloads/service-provider/3.5.1/","tags":["patch","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00015.html"},{"url":"http://seclists.org/fulldisclosure/2025/Sep/40"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9943"},{"url":"https://shibboleth.net/downloads/service-provider/3.5.1"},{"url":"https://github.com/advisories/GHSA-p7fp-v35q-pm7j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-9943","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622854-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249394","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9943","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263098-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263123-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-9943","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9943","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8768-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-9943","title":"Unauthenticated SQL Injection Vulnerability in Shibboleth Service Provider","description":"An SQL injection vulnerability has been identified in the \"ID\" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).\n\nThis issue affects Shibboleth Service Provider through 3.5.0.","status":"published","published":"2025-09-10T06:45:50.883Z","modified":"2025-11-04T22:06:49.754Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:34.096798Z"}],"euvd":[{"id":"EUVD-2025-27518","description":"An SQL injection vulnerability has been identified in the \"ID\" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).\n\nThis issue affects Shibboleth Service Provider through 3.5.0.","status":"published","published":"2025-09-10T06:45:50Z","modified":"2025-11-04T22:06:49Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:49:20.707326Z"}],"ghsa":[{"id":"GHSA-p7fp-v35q-pm7j","title":"An SQL injection vulnerability has been identified in the \"ID\" attribute of the SAML response...","description":"An SQL injection vulnerability has been identified in the \"ID\" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).\n\nThis issue affects Shibboleth Service Provider through 3.5.0.","status":"published","published":"2025-09-10T09:30:58Z","modified":"2025-11-05T00:32:30Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:04:39.50413Z"}],"nvd":[{"id":"CVE-2025-9943","description":"An SQL injection vulnerability has been identified in the \"ID\" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).\n\nThis issue affects Shibboleth Service Provider through 3.5.0.","status":"published","published":"2025-09-10T07:15:47.153Z","modified":"2026-09-26T00:10:00.127Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:11:28.834562Z"}],"osv":[{"id":"DEBIAN-CVE-2025-9943","description":"An SQL injection vulnerability has been identified in the \"ID\" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).  This issue affects Shibboleth Service Provider through 3.5.0.","status":"published","published":"2025-09-10T07:15:47.153Z","modified":"2026-09-26T08:47:39.450031309Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"UBUNTU-CVE-2025-9943","description":"An SQL injection vulnerability has been identified in the \"ID\" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271). This issue affects Shibboleth Service Provider through 3.5.0.","status":"published","published":"2025-09-10T07:15:00Z","modified":"2026-09-15T20:16:37.171451532Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"CVE-2025-9943","description":"An SQL injection vulnerability has been identified in the \"ID\" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).\n\nThis issue affects Shibboleth Service Provider through 3.5.0.","status":"published","published":"2025-09-10T07:15:47Z","modified":"2026-07-28T18:30:31.660709201Z","updated_at":"2026-11-02T15:44:53.490346Z"},{"id":"DLA-4300-1","title":"shibboleth-sp - security update","status":"published","published":"2025-09-14T00:00:00Z","modified":"2026-03-09T02:09:35.805655Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5994-1","title":"shibboleth-sp - security update","status":"published","published":"2025-09-07T00:00:00Z","modified":"2026-03-09T02:11:33.645356Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"openSUSE-SU-2025:15714-1","title":"libshibsp-lite12-3.5.1-1.1 on GA media","description":"These are all security issues fixed in the libshibsp-lite12-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-07T00:00:00Z","modified":"2026-03-23T04:54:07.421602Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:21418-1","title":"Security update for shibboleth-sp","description":"This update for shibboleth-sp fixes the following issue\n\n- CVE-2025-9943: SQL injection in the \"ID\" attribute of the SAML response when the replay cache of the Shibboleth\n  Service Provider (SP) is configured to use an SQL database as storage service (bsc#1249394).\n","status":"published","published":"2026-07-22T12:54:46Z","modified":"2026-07-24T18:24:26.794807129Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22854-1","title":"Security update for shibboleth-sp","description":"This update for shibboleth-sp fixes the following issue\n\n- CVE-2025-9943: SQL injection in the \"ID\" attribute of the SAML response when the replay cache of the Shibboleth\n  Service Provider (SP) is configured to use an SQL database as storage service (bsc#1249394).\n","status":"published","published":"2026-07-22T12:56:28Z","modified":"2026-07-28T18:24:10.625637716Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:3098-1","title":"Security update for shibboleth-sp","description":"This update for shibboleth-sp fixes the following issue:\n\n- CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cache of the Shibboleth\n  Service Provider (SP) is configured to use an SQL database as storage service (bsc#1249394).\n","status":"published","published":"2026-07-17T11:39:59Z","modified":"2026-07-18T08:45:08.753001799Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3123-1","title":"Security update for shibboleth-sp","description":"This update for shibboleth-sp fixes the following issue:\n\n- CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cache of the Shibboleth\n  Service Provider (SP) is configured to use an SQL database as storage service (bsc#1249394).\n","status":"published","published":"2026-07-20T07:01:11Z","modified":"2026-07-21T09:45:06.777726811Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8768-1","title":"shibboleth-sp vulnerability","description":"Florian Stuhlmann discovered that Shibboleth incorrectly escaped input\nwhen using the ODBC storage plugin. A remote attacker could possibly use\nthis issue to perform SQL injection attacks and obtain sensitive\ninformation.","status":"published","published":"2026-09-15T15:43:58Z","modified":"2026-09-16T02:57:27.463566Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}