BSD PortsShibboleth Service Provider -- SQL injection vulnerability in ODBC plugin
Internet2 reports: The Shibboleth Service Provider includes a storage API usable for a number of different use cases such as the session cache, replay cache, and relay state management. An ODBC extension plugin is provided with some distributions of the software (notably on Windows). A SQL injection vulnerability was identified in some of the queries issued by the plugin, and this can be creatively exploited through …
Affected versions
- shibboleth-sp < 3.5.1
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/shibboleth-sp | 3.5.0_3 | vulnerable since 2025-09-03 | |
| NetBSD | www/shibboleth-sp | 3.5.2nb4 | not listed | |
| FreeBSD | security/shibboleth-sp | 3.5.2 | fixed |