CVE-2021-31826

NameCVE-2021-31826
DescriptionShibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on systems not using this feature if a crafted cookie is supplied.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4905-1
NVD severitymedium
Debian Bugs987608

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
shibboleth-sp (PTS)buster, buster (security)3.0.4+dfsg1-1+deb10u2fixed
bullseye3.2.2+dfsg1-1fixed
bookworm, sid3.2.3+dfsg1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
shibboleth-spsourcebuster3.0.4+dfsg1-1+deb10u2DSA-4905-1
shibboleth-spsource(unstable)3.2.2+dfsg1-1987608

Notes

https://shibboleth.net/community/advisories/secadv_20210426.txt
https://issues.shibboleth.net/jira/browse/SSPCPP-927
https://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=5a47c3b9378f4c49392dd4d15189b70956f9f2ec

Search for package or bug name: Reporting problems