CVE-2017-16853

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-11-16 · updated 2026-06-17
Weakness: CWE-347

Description

The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.

Affected products

Debian Linux: 8.0, 9.0
Shibboleth Opensaml: before 2.6.1 — fixed in 2.6.1

How to fix

Upgrade to a fixed version: Shibboleth Opensaml 2.6.1. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/101898
https://bugs.debian.org/881856
https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d
https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html
https://shibboleth.net/community/advisories/secadv_20171115.txt
https://www.debian.org/security/2017/dsa-4039
http://www.securityfocus.com/bid/101898
https://bugs.debian.org/881856
https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d
https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html
https://shibboleth.net/community/advisories/secadv_20171115.txt
https://www.debian.org/security/2017/dsa-4039

Get alerted when CVE-2017-16853 or the next vulnerability affects your stack