Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pysaml2

7 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 medium
Registry
PyPI

Advisories 7

  • CVE-2021-21238Medium 6.5

    SAML XML Signature wrapping

    Affected: fixed in 6.5.0; fixed in 6.5.0.

  • CVE-2021-21239Medium 6.5

    Open default xmlsec1 key-type preference

    Affected: fixed in 6.5.0; fixed in 6.5.0.

  • PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it…

    Affected: fixed in 5.0.0; fixed in 5.0.0.

  • pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled.

    Affected: fixed in 4.5.0.

  • Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak…

    Affected: fixed in 4.6.0.

  • XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML…

    Affected: fixed in 4.5.0.

  • PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.

    Affected: fixed in 4.5.0.