Skip to content
Fencer Vulns
high 8.1

CVE-2017-16853 json

The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to p…

published 2017-11-16 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-8027

cvss
8.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.

Patch / fix

  • shibboleth opensaml 2.6.1
  • opensaml2 Ubuntu 14.04 LTS 2.5.3-2+deb8u2build0.14.04.1
  • opensaml2 Ubuntu 16.04 LTS 2.5.5-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2017-16853

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • opensaml SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2 +4 more 2.5.5-3.3.1

suse advisories SUSE-SU-2017:3234-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-16853 updated cvss 6.5

opensaml: The DynamicMetadataProvider class does not perform various security checks

  • Red Hat JBoss Data Grid 6 opensaml opensaml Red Hat JBoss Data Virtualization 6 opensaml opensaml Red Hat JBoss Enterprise Application Platform 6 opensaml opensaml Red Hat JBoss Enterprise Application Platform 7 opensaml-core Red Hat JBoss Fuse Service Works 6 opensaml opensaml Red Hat JBoss Operations Network 3 opensaml opensaml
    +1 more products
    Red Hat JBoss Portal 6 opensaml opensaml
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.40% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.