CVE-2025-9943

Name	CVE-2025-9943
Description	An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271). This issue affects Shibboleth Service Provider through 3.5.0.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-5994-1
Debian Bugs	1114506

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
shibboleth-sp (PTS)	bullseye	3.2.2+dfsg1-1	vulnerable
	bookworm	3.4.1+dfsg-2	vulnerable
	bookworm (security)	3.4.1+dfsg-2+deb12u1	fixed
	trixie	3.5.0+dfsg-2	vulnerable
	trixie (security)	3.5.0+dfsg-2+deb13u1	fixed
	forky, sid	3.5.1+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
shibboleth-sp	source	bookworm	3.4.1+dfsg-2+deb12u1	DSA-5994-1
shibboleth-sp	source	trixie	3.5.0+dfsg-2+deb13u1	DSA-5994-1
shibboleth-sp	source	(unstable)	3.5.1+dfsg-1		1114506

https://issues.shibboleth.net/jira/browse/SSPCPP-1014
https://shibboleth.net/community/advisories/secadv_20250903.txt