shibboleth2-sp -- "Dynamic" metadata provider plugin issue
The Internet2 community reports:
The Shibboleth Service Provider software includes a MetadataProvider
plugin with the plugin type "Dynamic" to obtain metadata on demand
from a query server, in place of the more typical mode of
downloading aggregates separately containing all of the metadata to
All the plugin types rely on MetadataFilter plugins to perform
critical security checks such as signature verification, enforcement
of validity periods, and other checks specific to deployments.
Due to a coding error, the "Dynamic" plugin fails to configure
itself with the filters provided to it and thus omits whatever
checks they are intended to perform, which will typically leave
deployments vulnerable to active attacks involving the substitution
of metadata if the network path to the query service is
Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright