Critical Authentication Bypass in pysaml2 Package - CVE-2017-1000433
Summary
CVE-2017-1000433: pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. Affects python-pysaml2 across 2 version ranges.
< 4.5.0-2
< 78261b9ae13c3855b33009cb1c5abc2c45839828
Fixed in 4.5.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pysaml2 is a Python library that implements the Security Assertion Markup Language (SAML) version 2.0, allowing for secure single sign-on (SSO) and identity management. It is widely used in applications that require federated identity management. The library is designed to facilitate the exchange of authentication and authorization data between parties, but it has a critical vulnerability that affects its security.
Vulnerability Detail
The vulnerability identified as CVE-2017-1000433 affects pysaml2 versions 4.4.0 and older. When Python optimizations are enabled, the library accepts any password, allowing attackers to log in as any user without needing to know their password. This flaw poses a significant security risk, as it can lead to unauthorized access to sensitive user accounts and data, potentially compromising the integrity of applications that rely on pysaml2 for authentication.
How To Fix
Minimum fixed version
4.5.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-pysaml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider disabling Python optimizations as a temporary measure. This can be done by running your Python application without optimizations, although this may impact performance. For example, you can run your script with the command: python -O your_script.py.
Conclusion
CVE-2017-1000433 is a critical vulnerability in the pysaml2 package that allows unauthorized access due to improper password handling. It is essential to upgrade to the latest version to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for python-pysaml2 →
FAQ
CVE-2017-1000433 is a vulnerability in the pysaml2 package that allows attackers to bypass authentication by accepting any password when Python optimizations are enabled.
pysaml2 versions 4.4.0 and older are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for CVE-2017-1000433 is 8.1, indicating a high severity level.
If an immediate upgrade is not possible, consider disabling Python optimizations as a temporary workaround until you can apply the fix.
Related vulnerabilities
Recent vulnerabilities recorded for python-pysaml2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
