CVE-2021-31826

2021-04-2704:15:08

Debian Security Bug Tracker

security-tracker.debian.org

shibboleth service provider

null pointer dereference

session recovery

crafted cookie

system vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

65.0%

JSON

Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on systems not using this feature if a crafted cookie is supplied.

OSVersionArchitecturePackageVersionFilename
Debian12allshibboleth-sp< 3.2.2+dfsg1-1shibboleth-sp_3.2.2+dfsg1-1_all.deb
Debian11allshibboleth-sp< 3.2.2+dfsg1-1shibboleth-sp_3.2.2+dfsg1-1_all.deb
Debian999allshibboleth-sp< 3.2.2+dfsg1-1shibboleth-sp_3.2.2+dfsg1-1_all.deb
Debian13allshibboleth-sp< 3.2.2+dfsg1-1shibboleth-sp_3.2.2+dfsg1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	shibboleth-sp	< 3.2.2+dfsg1-1	shibboleth-sp_3.2.2+dfsg1-1_all.deb
Debian	11	all	shibboleth-sp	< 3.2.2+dfsg1-1	shibboleth-sp_3.2.2+dfsg1-1_all.deb
Debian	999	all	shibboleth-sp	< 3.2.2+dfsg1-1	shibboleth-sp_3.2.2+dfsg1-1_all.deb
Debian	13	all	shibboleth-sp	< 3.2.2+dfsg1-1	shibboleth-sp_3.2.2+dfsg1-1_all.deb