CVE-2017-1000246: Vulnerability in pysaml2 package
Summary
CVE-2017-1000246: Pysaml2 improperly initializes encryption vector. Affects pysaml2 versions < 4.6.0. Fixed in 4.6.0. How to fix ↓
Also tracked for
- python-pysaml2 · Debian:11
The same CVE-2017-1000246 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pysaml2 package is a Python library that provides support for SAML 2.0 in Python applications. It allows developers to implement SAML-based Single Sign-On (SSO) and Single Logout (SLO) functionality. The package is widely used in various Python projects and is available on the Python Package Index (PyPI). However, versions up to 4.5.0 of pysaml2 suffer from a moderate severity vulnerability.
Vulnerability Detail
The vulnerability in pysaml2 version 4.5.0 and earlier arises from the reuse of the initialization vector (IV) during encryption in the IDP server. This leads to weak encryption of data, potentially exposing sensitive information to attackers. The weak encryption can be exploited by an adversary to decrypt the encrypted data and gain unauthorized access to sensitive information. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.6.0
This is the first release that contains the fix.
pip install --upgrade "pysaml2==4.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The pysaml2 package up to version 4.5.0 is vulnerable to weak encryption due to the reuse of the initialization vector. To mitigate this vulnerability, it is crucial to upgrade to version 4.6.0 or later. For further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for pysaml2 →
FAQ
The vulnerability allows an attacker to potentially decrypt sensitive data that is encrypted using weak encryption in the pysaml2 package.
At the moment, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the pysaml2 package.
No, only versions up to 4.5.0 of the pysaml2 package are affected. Version 4.6.0 and later include a fix for the vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
For more information about this vulnerability, you can refer to the GitHub advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-cq94-qf6q-mf2h/GHSA-cq94-qf6q-mf2h.json
References
Related vulnerabilities
Recent vulnerabilities recorded for pysaml2.
