Vulnerability · Published Apr 27, 2021 · Assigned by mitre
CVE-2021-31826
High 7.5
In plain English
A high-severity security flaw in the shibboleth-sp package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.0%top 19.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on systems not using this feature if a crafted cookie is supplied.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | shibboleth-sp | 3.2.2+dfsg1-1 | DEBIAN-CVE-2021-31826 |
| Debian:13 | shibboleth-sp | 3.2.2+dfsg1-1 | DEBIAN-CVE-2021-31826 |
| Debian:14 | shibboleth-sp | 3.2.2+dfsg1-1 | DEBIAN-CVE-2021-31826 |
Affected products (as reported)
References
- https://shibboleth.net/community/advisories/secadv_20210426.txt x_refsource_MISC
- https://issues.shibboleth.net/jira/browse/SSPCPP-927 x_refsource_MISC
- https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=5a47c3b9378f4c49392dd4d15189b70956f9f2ec x_refsource_MISC
- https://bugs.debian.org/987608 x_refsource_MISC
- DSA-4905 vendor-advisory, x_refsource_DEBIAN