{"action":"Upgrade shibboleth-sp to 3.4.1+dfsg-2+deb12u1 or later.","affected":[{"fixed":"3.4.1+dfsg-2+deb12u1","introduced":"0"}],"component":"shibboleth-sp","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["3.4.1+dfsg-2+deb12u1"],"id":"tcs_01M5NPF0SSTHYY7EHKF07GDS9R","modified_at":"2026-09-26T08:47:39.450031309Z","published_at":"2025-09-10T07:15:47.153Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-9943","https://security-tracker.debian.org/tracker/CVE-2025-9943"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-9943","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-9943"}],"summary":"An SQL injection vulnerability has been identified in the \"ID\" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as stor"}