{"id":"UBUNTU-CVE-2021-28963","details":"Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters.","modified":"2026-09-15T20:16:38.414609663Z","published":"2021-03-22T08:15:00Z","related":["USN-4925-1"],"upstream":["CVE-2021-28963"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-28963"},{"type":"REPORT","url":"https://shibboleth.net/community/advisories/secadv_20210317.txt"},{"type":"REPORT","url":"https://issues.shibboleth.net/jira/browse/SSPCPP-922"},{"type":"REPORT","url":"https://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=d1dbebfadc1bdb824fea63843c4c38fa69e54379"},{"type":"REPORT","url":"https://bugs.debian.org/985405"},{"type":"REPORT","url":"https://www.debian.org/security/2021/dsa-4872"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-4925-1"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2021-28963"}],"affected":[{"package":{"name":"shibboleth-sp2","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/shibboleth-sp2?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.3+dfsg-2.1build1"],"ecosystem_specific":{"binaries":[{"binary_version":"2.5.3+dfsg-2.1build1","binary_name":"libapache2-mod-shib2"},{"binary_name":"libshibsp-plugins","binary_version":"2.5.3+dfsg-2.1build1"},{"binary_name":"libshibsp6","binary_version":"2.5.3+dfsg-2.1build1"},{"binary_version":"2.5.3+dfsg-2.1build1","binary_name":"shibboleth-sp2-common"},{"binary_version":"2.5.3+dfsg-2.1build1","binary_name":"shibboleth-sp2-schemas"},{"binary_version":"2.5.3+dfsg-2.1build1","binary_name":"shibboleth-sp2-utils"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-28963.json"}},{"package":{"name":"shibboleth-sp2","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/shibboleth-sp2?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg1-4","2.6.0+dfsg1-5","2.6.0+dfsg1-5build1","2.6.1+dfsg1-1","2.6.1+dfsg1-2"],"ecosystem_specific":{"binaries":[{"binary_version":"2.6.1+dfsg1-2","binary_name":"libapache2-mod-shib2"},{"binary_name":"libshibsp-plugins","binary_version":"2.6.1+dfsg1-2"},{"binary_version":"2.6.1+dfsg1-2","binary_name":"libshibsp7"},{"binary_name":"shibboleth-sp2-common","binary_version":"2.6.1+dfsg1-2"},{"binary_name":"shibboleth-sp2-utils","binary_version":"2.6.1+dfsg1-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-28963.json"}},{"package":{"name":"shibboleth-sp","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/shibboleth-sp?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4+dfsg1-1ubuntu0.1"}]}],"versions":["3.0.4+dfsg1-1","3.0.4+dfsg1-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libapache2-mod-shib","binary_version":"3.0.4+dfsg1-1ubuntu0.1"},{"binary_name":"libapache2-mod-shib2","binary_version":"3.0.4+dfsg1-1ubuntu0.1"},{"binary_version":"3.0.4+dfsg1-1ubuntu0.1","binary_name":"libshibsp-plugins"},{"binary_name":"libshibsp8","binary_version":"3.0.4+dfsg1-1ubuntu0.1"},{"binary_name":"shibboleth-sp-common","binary_version":"3.0.4+dfsg1-1ubuntu0.1"},{"binary_name":"shibboleth-sp-utils","binary_version":"3.0.4+dfsg1-1ubuntu0.1"},{"binary_version":"3.0.4+dfsg1-1ubuntu0.1","binary_name":"shibboleth-sp2-common"},{"binary_name":"shibboleth-sp2-utils","binary_version":"3.0.4+dfsg1-1ubuntu0.1"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-28963.json"}},{"package":{"name":"shibboleth-sp","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/shibboleth-sp?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.2+dfsg1-1ubuntu1","3.3.0+dfsg1-1","3.3.0+dfsg1-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"libapache2-mod-shib","binary_version":"3.3.0+dfsg1-1ubuntu0.1~esm1"},{"binary_name":"libshibsp-plugins","binary_version":"3.3.0+dfsg1-1ubuntu0.1~esm1"},{"binary_version":"3.3.0+dfsg1-1ubuntu0.1~esm1","binary_name":"libshibsp10"},{"binary_name":"shibboleth-sp-common","binary_version":"3.3.0+dfsg1-1ubuntu0.1~esm1"},{"binary_name":"shibboleth-sp-utils","binary_version":"3.3.0+dfsg1-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-28963.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]}