CVE-2021-31826 Null dereference in n/a
A crafted cookie can trigger a NULL pointer dereference in Shibboleth Service Provider, causing a daemon crash and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-31826?
CVE-2021-31826 is a high-severity vulnerability in n/a, published on 27 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on systems not using this feature if a crafted cookie is supplied.
Weakness: CWE-476
Which versions are affected by CVE-2021-31826?
It affects 1 product.
Products include Shibboleth Service Provider.
How do I fix CVE-2021-31826?
Upgrade to a fixed version.
Is CVE-2021-31826 being exploited?
There is no known exploitation of CVE-2021-31826 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2021-31826, DSA-4905-1, GHSA-rqpx-m7mv-mxxf, UBUNTU-CVE-2021-31826.