Debian/shibboleth-sp: critical 9.1
An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as stor
Action: Upgrade shibboleth-sp to 3.5.0+dfsg-2+deb13u1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.5.0+dfsg-2+deb13u1 | - |
Fixed versions
| 3.5.0+dfsg-2+deb13u1 |
Sources
- osv: DEBIAN-CVE-2025-9943#Debian:13/shibboleth-sp
- https://security-tracker.debian.org/tracker/CVE-2025-9943
published · modified · JSON