CVE-2021-21238: PySAML2 Improper Verification of Cryptographic Signature
Summary
CVE-2021-21238: PySAML2 is a pure python implementation of SAML Version 2 Standard. Affects pysaml2 across 2 version ranges.
< 1d8fd268f5bf887480a403a7a5ef8f048157cc14
< 6.5.0
Fixed in 1d8fd268f5bf887480a403a7a5ef8f048157cc14. How to fix ↓
Also tracked for
- python-pysaml2 · Debian:11
The same CVE-2021-21238 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PySAML2 is a pure python implementation of the SAML Version 2 Standard. It is used for validating signed SAML documents. PySAML2 before version 6.5.0 is affected by an improper verification of cryptographic signature vulnerability. This vulnerability is a variant of XML Signature wrapping and occurs because PySAML2 did not validate the SAML document against an XML schema. As a result, invalid XML documents can be processed, allowing a document to trick PySAML2 with a wrapped signature.
Vulnerability Detail
The vulnerability in PySAML2 allows for the processing of invalid XML documents with wrapped signatures. An attacker can exploit this vulnerability to bypass signature verification and potentially perform unauthorized actions. This can lead to various security risks, such as impersonation, privilege escalation, and information disclosure.
How To Fix
Minimum fixed version
1d8fd268f5bf887480a403a7a5ef8f048157cc14
This is the first release that contains the fix.
pip install --upgrade "pysaml2==1d8fd268f5bf887480a403a7a5ef8f048157cc14"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of PySAML2 to mitigate the risk.
Conclusion
The vulnerability in PySAML2 allows for the processing of invalid XML documents with wrapped signatures, potentially bypassing signature verification. To mitigate this risk, it is crucial to upgrade to PySAML2 version 6.5.0 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for pysaml2 →
FAQ
PySAML2 is a pure python implementation of the SAML Version 2 Standard. It is used for validating signed SAML documents.
The vulnerability allows for the processing of invalid XML documents with wrapped signatures, potentially bypassing signature verification and leading to security risks such as impersonation, privilege escalation, and information disclosure.
To fix this vulnerability, it is recommended to upgrade to PySAML2 version 6.5.0 or later.
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of PySAML2.
For more information about this vulnerability, you can refer to the PySAML2 advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/pysaml2/PYSEC-2021-48.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for pysaml2.
