CVE-2021-31826: Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature

High severity · published Apr 27, 2021

CVE-2021-31826

Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature

7.5

CVSS

EPSS

On KEV

Description

Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on systems not using this feature if a crafted cookie is supplied.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.0% · higher than 81% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Service Provider · Shibboleth

3.0.0 before 3.2.2 · source: NVD

Affected product

Service Provider

Shibboleth

All Service Provider CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-31826

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-31826

Mailing List

https://bugs.debian.org/987608

git.shibboleth.net

https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=5a47c3b9378f4c49392dd4d15189b70956f9f2ec

Exploit

https://issues.shibboleth.net/jira/browse/SSPCPP-927

Vendor Advisory

https://shibboleth.net/community/advisories/secadv_20210426.txt

Third Party Advisory

https://www.debian.org/security/2021/dsa-4905