Home / mailings

PDF

[USN-8768-1] Shibboleth vulnerability

Posted on 15 September 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8768-1
September 15, 2026

shibboleth-sp vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Shibboleth could be made to expose sensitive information over the
network.

Software Description:
- shibboleth-sp: Federated web single sign-on system

Details:

Florian Stuhlmann discovered that Shibboleth incorrectly escaped input
when using the ODBC storage plugin. A remote attacker could possibly use
this issue to perform SQL injection attacks and obtain sensitive
information.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
libshibsp11t64 3.4.1+dfsg-2.1ubuntu0.1~esm1
Available with Ubuntu Pro
shibboleth-sp-common 3.4.1+dfsg-2.1ubuntu0.1~esm1
Available with Ubuntu Pro
shibboleth-sp-utils 3.4.1+dfsg-2.1ubuntu0.1~esm1
Available with Ubuntu Pro

Ubuntu 22.04 LTS
libshibsp10 3.3.0+dfsg1-1ubuntu0.1~esm1
Available with Ubuntu Pro
shibboleth-sp-common 3.3.0+dfsg1-1ubuntu0.1~esm1
Available with Ubuntu Pro
shibboleth-sp-utils 3.3.0+dfsg1-1ubuntu0.1~esm1
Available with Ubuntu Pro

Ubuntu 20.04 LTS
libshibsp8 3.0.4+dfsg1-1ubuntu0.2+esm1
Available with Ubuntu Pro
shibboleth-sp-common 3.0.4+dfsg1-1ubuntu0.2+esm1
Available with Ubuntu Pro
shibboleth-sp-utils 3.0.4+dfsg1-1ubuntu0.2+esm1
Available with Ubuntu Pro
shibboleth-sp2-common 3.0.4+dfsg1-1ubuntu0.2+esm1
Available with Ubuntu Pro
shibboleth-sp2-utils 3.0.4+dfsg1-1ubuntu0.2+esm1
Available with Ubuntu Pro

After a standard system update you need to restart shibboleth-sp to make
all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8768-1
CVE-2025-9943

--===============4654861580311820439==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP