USN-4925-1: Shibboleth vulnerability

Releases

• Ubuntu 20.04 LTS

Packages

• shibboleth-sp - Federated web single sign-on system

Details

Toni Huttunen and Fraktal Oy discovered that the Shibboleth Service
provider allowed content injection due to allowing attacker-controlled
parameters in error or other status pages. An attacker could use this to
inject malicious content.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• libapache2-mod-shib - 3.0.4+dfsg1-1ubuntu0.1
• libshibsp-plugins - 3.0.4+dfsg1-1ubuntu0.1
• libshibsp8 - 3.0.4+dfsg1-1ubuntu0.1
• shibboleth-sp-common - 3.0.4+dfsg1-1ubuntu0.1
• shibboleth-sp-utils - 3.0.4+dfsg1-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2021-28963