Shibboleth Service Provider Security Advisory [3 September 2025]

[Cantor, Scott]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Shibboleth Service Provider Security Advisory [3 September 2025]

An updated version of the Shibboleth Service Provider is available
to correct a SQL injection vulnerability in the ODBC StorageService
extension shipped with some distributions of the software.

The vulnerability is moderate to high severity for anyone using
the ODBC plugin, and of no impact for others.

SQL injection vulnerability in Service Provider ODBC plugin
===========================================================
The Shibboleth Service Provider includes a storage API usable
for a number of different use cases such as the session cache,
replay cache, and relay state management. An ODBC extension
plugin is provided with some distributions of the software
(notably on Windows).

A SQL injection vulnerability was identified in some of the
queries issued by the plugin, and this can be creatively
exploited through specially crafted inputs to exfiltrate
information stored in the database used by the SP.

Recommendations
===============
Update to V3.5.1 (or later) of the Shibboleth Service Provider,
or if you cannot, then migrate off of the ODBC storage 
plugin/extension.

Restarting the shibd process is sufficient to apply the change,
as the affected code runs only within that process.


Credits
=======
SEC Consult Vulnerability Lab
Florian Stuhlmann

URL for this Security Advisory:
https://shibboleth.net/community/advisories/secadv_20250903.txt

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3KoVAHvtneaQzZUjN4uEVAIneWIFAmi4hhQACgkQN4uEVAIn
eWLZNg/+NQGQoBOs72Z4EfcHHQ5vcO/g/Mfxe/AjCH7kvCAtLwh+Lgnj/KVaok8G
jDmETysY90rXcPSF1oNquWlzvf3o59CX6yjT/M5aMjpslxqozOZhbtFSSdiOXuTa
KK0IENVImAEjSf9R5zgdLHJGZj3EF+W1gLu2PtkEhnJ1CotvO4pu6Wn/ziyFtEw/
xSKlT2J5qZ1FnsHs+I2ACplcnaDVZ7zkRIP+c1/p+HmSOB40GaSsNre1YKkAiXkW
OaFnnDvr9azyalGPp3JZnAt22blTXIXsE6cLas1uToZ8wub3MDruGaDOXaErXZxD
CNh+S9cxURrzimJWriUGTxL5xjmoltkHJ9aGsI7vDYU5mHkgc9UAsRQZpkbFFE3U
Tof7h498SEh5r11+1Ngz+lZHXpXZZLk3CFECB1ybknY2XONBLKqDfTr4sYzcWDi8
x/1Sq0gd7aOGbaMYdoif2kSXrQyGodzrNi81WR/Kr5YkY4EYIvbUtOM9jBgStyy7
nF6jXBg+R3GMLtC5PBIBHrZT8CQApD2smcxKZ+3UKqKFF6qgqHeUS2q/+cobvR5m
D/wJHnr9/YARGuPQv7MHLs2EpCIAW8Pl7UDVZXS9rZ7v1KCJoHWzIm8L1Foraae8
9pFr+EQAo/ZNj9dS7fgsSY/7OQr2IMGw0FYOzsv5pkRomk0yBhk=
=Vm+n
-----END PGP SIGNATURE-----


-- Scott