{"schemaVersion":3,"id":"CVE-2017-16853","aliases":["SUSE-SU-2017:3234-1","UBUNTU-CVE-2017-16853","DLA-1178-1","DSA-4039-1"],"status":"published","duplicateOf":null,"title":null,"description":"The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.","dates":{"published":"2017-11-16T17:00:00.000Z","modified":"2024-08-05T20:35:21.236Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.1,"severity":"high","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":8.1,"severity":"high","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Ubuntu","score":8.1,"severity":"high","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":5.6,"impact":9.8,"computed":true}]},"epss":{"probability":0.01398,"percentile":0.7203,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.01398},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01307,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01398,"percentile":0.7203}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01307,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01398,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01398,"percentile":0.7203}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature","description":"The product does not verify, or incorrectly verifies, the cryptographic signature for data.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/347.html"}],"affected":[{"vendor":"debian","product":"opensaml2","name":"opensaml2","label":"opensaml2","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/opensaml2","purlType":"deb","versions":[{"text":"< 2.5.3-2+deb8u2","noFixRecorded":false,"fixedIn":null},{"text":"< 2.6.0-4+deb9u1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.4.3-4+deb7u2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.3-2+deb8u2 | < 2.6.0-4+deb9u1 | < 2.4.3-4+deb7u2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"opensaml2","name":"opensaml2","label":"opensaml2","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/opensaml2","purlType":"deb","versions":[{"text":"< 2.5.3-2+deb8u2build0.14.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.5.5-1ubuntu0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.3-2+deb8u2build0.14.04.1 | < 2.5.5-1ubuntu0.1","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"8.0","noFixRecorded":false,"fixedIn":null},{"text":"9.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.0 | 9.0","eol":{"isEol":true,"eolDate":"2020-06-30T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"8","label":"8 (Jessie)","eolFrom":"2020-06-30T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"8.11"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"suse","product":"opensaml&distro=SUSE Linux Enterprise Server 12 SP2","name":"opensaml","label":"opensaml&distro=SUSE Linux Enterprise Server 12 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/opensaml&distro=SUSE Linux Enterprise Server 12 SP2","purlType":"rpm","versions":[{"text":"< 2.5.5-3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.5-3.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"opensaml&distro=SUSE Linux Enterprise Server 12 SP3","name":"opensaml","label":"opensaml&distro=SUSE Linux Enterprise Server 12 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/opensaml&distro=SUSE Linux Enterprise Server 12 SP3","purlType":"rpm","versions":[{"text":"< 2.5.5-3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.5-3.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"opensaml&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2","name":"opensaml","label":"opensaml&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/opensaml&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2","purlType":"rpm","versions":[{"text":"< 2.5.5-3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.5-3.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"opensaml&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2","name":"opensaml","label":"opensaml&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/opensaml&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2","purlType":"rpm","versions":[{"text":"< 2.5.5-3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.5-3.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"opensaml&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3","name":"opensaml","label":"opensaml&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/opensaml&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3","purlType":"rpm","versions":[{"text":"< 2.5.5-3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.5-3.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"opensaml&distro=SUSE Linux Enterprise Software Development Kit 12 SP2","name":"opensaml","label":"opensaml&distro=SUSE Linux Enterprise Software Development Kit 12 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/opensaml&distro=SUSE Linux Enterprise Software Development Kit 12 SP2","purlType":"rpm","versions":[{"text":"< 2.5.5-3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.5-3.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"opensaml&distro=SUSE Linux Enterprise Software Development Kit 12 SP3","name":"opensaml","label":"opensaml&distro=SUSE Linux Enterprise Software Development Kit 12 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/opensaml&distro=SUSE Linux Enterprise Software Development Kit 12 SP3","purlType":"rpm","versions":[{"text":"< 2.5.5-3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.5-3.3.1","eol":null,"hubHref":null},{"vendor":"shibboleth","product":"opensaml","name":"opensaml","label":"opensaml","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.6.1","eol":null,"hubHref":"/vendor/shibboleth/opensaml"}],"affectedCount":11,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://www.debian.org/security/2017/dsa-4039","label":"www.debian.org/security/2017/dsa-4039","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Issue Tracking","Third Party Advisory"]},{"url":"https://bugs.debian.org/881856","label":"bugs.debian.org/881856","hostname":"bugs.debian.org","tags":["X Refsource CONFIRM","Issue Tracking","Third Party Advisory","REPORT"]},{"url":"http://www.securityfocus.com/bid/101898","label":"www.securityfocus.com/bid/101898","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d","label":"git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d","hostname":"git.shibboleth.net","tags":["X Refsource CONFIRM"]},{"url":"https://shibboleth.net/community/advisories/secadv_20171115.txt","label":"shibboleth.net/community/advisories/secadv_20171115.txt","hostname":"shibboleth.net","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory","REPORT"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html","label":"lists.debian.org/debian-lts-announce/2017/11/msg00024.html","hostname":"lists.debian.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173234-1/","label":"www.suse.com/support/update/announcement/2017/suse-su-20173234-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1068685","label":"bugzilla.suse.com/1068685","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16853","label":"www.suse.com/security/cve/CVE-2017-16853","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2017-16853","label":"ubuntu.com/security/CVE-2017-16853","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=6182b0acf2df670e75423c2ed7afe6950ef11c9d","label":"git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=6182b0acf2df670e75423c2ed7afe6950ef11c9d","hostname":"git.shibboleth.net","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16853","label":"www.cve.org/CVERecord?id=CVE-2017-16853","hostname":"www.cve.org","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2017-11-16T17:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T20:35:21.236Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":33,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T10:40:47.995Z","stale":false,"partial":false}}