CVE-2017-16852

Name of the Vulnerable Software and Affected Versions Shibboleth Service Provider versions prior to 2.6.1

Description The issue arises from the Dynamic MetadataProvider plugin in Shibboleth Service Provider, which fails to properly configure itself with the MetadataFilter plugins. This failure leads to the omission of critical security checks, including signature verification and enforcement of validity periods, among other deployment-specific checks.

Recommendations For versions prior to 2.6.1, update to version 2.6.1 or later to resolve the issue.