PySAML2: Security bypass

Background

PySAML2 is a pure python implementation of SAML2

Description

It was found that the PySAML2 relies on an assert statement to check the user’s password. A python optimizations might remove this assertion.

Impact

A remote attacker could bypass security restrictions and access any application which is using PySAML2 for authentication.

Workaround

Disable python optimizations.

Resolution

All PySAML2 4.0 users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-python/pysaml2-4.0.2-r3"

All PySAML2 4.5 users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-python/pysaml2-4.5.0"