CVE-2021-21239: PySAML2 Improper Verification of Cryptographic Signature Vulnerability
Summary
CVE-2021-21239: PySAML2 is a pure python implementation of SAML Version 2 Standard. Affects pysaml2 across 2 version ranges.
< 6.5.0
< 46578df0695269a16f1c94171f1429873f90ed99
Fixed in 46578df0695269a16f1c94171f1429873f90ed99. How to fix ↓
Also tracked for
- python-pysaml2 · Debian:11
The same CVE-2021-21239 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PySAML2 is a pure python implementation of the SAML Version 2 Standard. It is used by applications to enable Single Sign-On (SSO) functionality, allowing users to authenticate once and access multiple systems without the need for separate logins. PySAML2 provides the necessary tools and libraries to generate, sign, and verify SAML documents. However, prior to version 6.5.0, PySAML2 had an improper verification of cryptographic signature vulnerability.
Vulnerability Detail
The vulnerability in PySAML2 arises from the default CryptoBackendXmlSec1 backend, which uses the xmlsec1 binary to verify the signature of signed SAML documents. However, xmlsec1 accepts any type of key found within the document by default, without explicitly ensuring that the document is correctly signed using only x509 certificates. This means that a malicious actor could potentially craft a SAML document with an invalid or forged signature, bypassing the verification process and gaining unauthorized access to protected resources. This vulnerability impacts users of PySAML2 who rely on the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents.
How To Fix
Minimum fixed version
46578df0695269a16f1c94171f1429873f90ed99
This is the first release that contains the fix.
pip install --upgrade "pysaml2==46578df0695269a16f1c94171f1429873f90ed99"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of PySAML2 as soon as possible.
Conclusion
PySAML2 versions prior to 6.5.0 are vulnerable to an improper verification of cryptographic signature issue. This could potentially allow unauthorized access to protected resources. Users of PySAML2 should upgrade to version 6.5.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pysaml2 →
FAQ
PySAML2 is a pure python implementation of the SAML Version 2 Standard, providing tools and libraries for SAML-based Single Sign-On (SSO) functionality.
Users of PySAML2 who rely on the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are affected by this vulnerability.
The vulnerability allows for the possibility of unauthorized access to protected resources if a malicious actor crafts a SAML document with an invalid or forged signature.
To fix this vulnerability, upgrade to PySAML2 version 6.5.0 or later, which addresses the issue and ensures proper verification of the cryptographic signature.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of PySAML2.
Related vulnerabilities
Recent vulnerabilities recorded for pysaml2.
