Security Update for python-pysaml2
Summary
DLA-2577-1: python-pysaml2 - security update. Affects python-pysaml2 versions < 3.0.0-5+deb9u2. Fixed in 3.0.0-5+deb9u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
python-pysaml2 is a pure python implementation of the SAML Version 2 Standard. It is used for implementing SAML-based Single Sign-On (SSO) authentication in Python applications. This package provides functionality for generating and consuming SAML assertions, handling SAML protocols, and managing SAML metadata. However, python-pysaml2 is vulnerable to two security issues.
Vulnerability Detail
The first vulnerability, identified as CVE-2017-1000433, allows attackers to log in as any user without knowing their password. This occurs when python-pysaml2 is run with Python optimizations enabled, as it accepts any password. The second vulnerability, known as CVE-2021-21239, affects users of pysaml2 that use the default CryptoBackendXmlSec1 backend to verify signed SAML documents. PySAML2 does not ensure that a signed SAML document is correctly signed, as the default xmlsec1 binary used by CryptoBackendXmlSec1 accepts any type of key found within the document. This can lead to the acceptance of invalid signatures.
How To Fix
Minimum fixed version
3.0.0-5+deb9u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-pysaml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, python-pysaml2 is vulnerable to two security issues that can allow unauthorized access and acceptance of invalid signatures. It is crucial to upgrade to version 3.0.0-5+deb9u2 or later to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python-pysaml2 →
FAQ
python-pysaml2 is a pure python implementation of the SAML Version 2 Standard. It is used for implementing SAML-based Single Sign-On (SSO) authentication in Python applications.
CVE-2017-1000433 is a vulnerability in python-pysaml2 that allows attackers to log in as any user without knowing their password when the package is run with Python optimizations enabled.
CVE-2021-21239 is a vulnerability in python-pysaml2 that affects users of the default CryptoBackendXmlSec1 backend. It allows the acceptance of invalid signatures in signed SAML documents.
To fix these vulnerabilities, you should upgrade your python-pysaml2 package to version 3.0.0-5+deb9u2 or later.
No specific workaround is mentioned for these vulnerabilities. It is recommended to upgrade to the fixed version of the package.
Related vulnerabilities
Recent vulnerabilities recorded for python-pysaml2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
