| Package | Affected versions | Patched versions |
|---|---|---|
| identity provider | ≥ 3.0.0, < 3.4.6 | 3.4.6 |
Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects in the Java Servlet container session.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free