CVE-2021-31826: 
Shibboleth Service Provider vulnerability analysis and mitigation

Shibboleth Service Provider 3.x before version 3.2.2 contained a NULL pointer dereference vulnerability (CVE-2021-31826) in its session recovery feature. The vulnerability was discovered and disclosed on April 26, 2021, affecting all 3.x versions prior to 3.2.2. The flaw impacted systems even when not using the session recovery feature if a specially crafted cookie was supplied (Debian Advisory, Shibboleth Advisory).

The vulnerability stems from a NULL pointer dereference flaw in the cookie-based session recovery feature that was introduced in version 3.0. The issue manifests as a crash in the shibd daemon/service process when a specially crafted cookie is supplied. The vulnerability received a CVSS v3.1 Base Score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating its severity and remote exploitability (NVD).

The vulnerability allows a remote, unauthenticated attacker to cause a denial of service condition by crashing the shibd daemon/service process. This impact is particularly significant as it affects systems even when they are not actively using the session recovery feature (Shibboleth Advisory).

The vulnerability is easily exploitable by remote, unauthenticated attackers through the submission of a specially crafted cookie. No special conditions or complex attack vectors are required to exploit this flaw. Versions prior to V3.0 are not vulnerable to this particular issue (Shibboleth Advisory).

The primary mitigation is to update to Shibboleth Service Provider version 3.2.2 or later. For cases where immediate updating is not possible, a temporary workaround involves configuring a DataSealer component in shibboleth2.xml, even if it's not actively used. This workaround is only applicable after updating the core configuration to the V3 XML namespace (Shibboleth Advisory).