<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for shibboleth-sp</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2017:3229-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2017-12-06T21:36:07Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2017-12-06T21:36:07Z</InitialReleaseDate>
    <CurrentReleaseDate>2017-12-06T21:36:07Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for shibboleth-sp</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for shibboleth-sp fixes the following issues:

Security issue fixed:

- CVE-2017-16852: Fix critical security checks in the Dynamic MetadataProvider plugin in Shibboleth Service (bsc#1068689).

This update was imported from the SUSE:SLE-12-SP1:Update update project.</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/opensuse-security-announce/2017-12/msg00013.html</URL>
      <Description>E-Mail link for openSUSE-SU-2017:3229-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="openSUSE Leap 42.2">
      <Branch Type="Product Name" Name="openSUSE Leap 42.2">
        <FullProductName ProductID="openSUSE Leap 42.2">openSUSE Leap 42.2</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="openSUSE Leap 42.3">
      <Branch Type="Product Name" Name="openSUSE Leap 42.3">
        <FullProductName ProductID="openSUSE Leap 42.3">openSUSE Leap 42.3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libshibsp-lite6-2.5.5-9.2">
      <FullProductName ProductID="libshibsp-lite6-2.5.5-9.2">libshibsp-lite6-2.5.5-9.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libshibsp6-2.5.5-9.2">
      <FullProductName ProductID="libshibsp6-2.5.5-9.2">libshibsp6-2.5.5-9.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="shibboleth-sp-2.5.5-9.2">
      <FullProductName ProductID="shibboleth-sp-2.5.5-9.2">shibboleth-sp-2.5.5-9.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="shibboleth-sp-devel-2.5.5-9.2">
      <FullProductName ProductID="shibboleth-sp-devel-2.5.5-9.2">shibboleth-sp-devel-2.5.5-9.2</FullProductName>
    </Branch>
    <Relationship ProductReference="libshibsp-lite6-2.5.5-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.2">
      <FullProductName ProductID="openSUSE Leap 42.2:libshibsp-lite6-2.5.5-9.2">libshibsp-lite6-2.5.5-9.2 as a component of openSUSE Leap 42.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="libshibsp6-2.5.5-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.2">
      <FullProductName ProductID="openSUSE Leap 42.2:libshibsp6-2.5.5-9.2">libshibsp6-2.5.5-9.2 as a component of openSUSE Leap 42.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="shibboleth-sp-2.5.5-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.2">
      <FullProductName ProductID="openSUSE Leap 42.2:shibboleth-sp-2.5.5-9.2">shibboleth-sp-2.5.5-9.2 as a component of openSUSE Leap 42.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="shibboleth-sp-devel-2.5.5-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.2">
      <FullProductName ProductID="openSUSE Leap 42.2:shibboleth-sp-devel-2.5.5-9.2">shibboleth-sp-devel-2.5.5-9.2 as a component of openSUSE Leap 42.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="libshibsp-lite6-2.5.5-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:libshibsp-lite6-2.5.5-9.2">libshibsp-lite6-2.5.5-9.2 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libshibsp6-2.5.5-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:libshibsp6-2.5.5-9.2">libshibsp6-2.5.5-9.2 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="shibboleth-sp-2.5.5-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:shibboleth-sp-2.5.5-9.2">shibboleth-sp-2.5.5-9.2 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="shibboleth-sp-devel-2.5.5-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:shibboleth-sp-devel-2.5.5-9.2">shibboleth-sp-devel-2.5.5-9.2 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.</Note>
    </Notes>
    <CVE>CVE-2017-16852</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.2:libshibsp-lite6-2.5.5-9.2</ProductID>
        <ProductID>openSUSE Leap 42.2:libshibsp6-2.5.5-9.2</ProductID>
        <ProductID>openSUSE Leap 42.2:shibboleth-sp-2.5.5-9.2</ProductID>
        <ProductID>openSUSE Leap 42.2:shibboleth-sp-devel-2.5.5-9.2</ProductID>
        <ProductID>openSUSE Leap 42.3:libshibsp-lite6-2.5.5-9.2</ProductID>
        <ProductID>openSUSE Leap 42.3:libshibsp6-2.5.5-9.2</ProductID>
        <ProductID>openSUSE Leap 42.3:shibboleth-sp-2.5.5-9.2</ProductID>
        <ProductID>openSUSE Leap 42.3:shibboleth-sp-devel-2.5.5-9.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.1</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:C/I:C/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.4</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2017-12/msg00013.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-16852.html</URL>
        <Description>CVE-2017-16852</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1068689</URL>
        <Description>SUSE Bug 1068689</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
