CVE-2020-27978

Name of the Vulnerable Software and Affected Versions Shibboleth Identify Provider versions prior to 3.4.6

Description The issue is a denial of service flaw that allows a remote unauthenticated attacker to cause a login flow to trigger Java heap exhaustion. This occurs due to the creation of objects in the Java Servlet container session.

Recommendations For versions prior to 3.4.6, update to version 3.4.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the login flow to minimize the risk of exploitation.