django-saml2-auth (>=1.0.2b1, <=1.1.4), django-saml2-auth-custom (>=1.0.0, <=1.0.4) potentially affected by CVE-2021-21239 via pysaml2 (4.0.5)

pysaml2 PYPI version 4.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - django-saml2-auth =1.0.2b1, =1.0.0, =1.0.4 Source cves: CVE-2021-21239 Source advisory: OSV:GHSA-5P3X-R448-PC62...

satosa (>=3.3.1, <=3.4.0) potentially affected by CVE-2021-21239 via pysaml2 (4.2.0)

pysaml2 PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - satosa =3.3.1, =3.4.0 Source cves: CVE-2021-21239 Source advisory: OSV:GHSA-5P3X-R448-PC62...

djangosaml2 (0.16.11), irisrelay (1.2.1) +1 more potentially affected by CVE-2021-21239 via pysaml2 (4.4.0)

pysaml2 PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - djangosaml2 0.16.11 - irisrelay 1.2.1 - satosa =3.4.2, =3.4.8 Source cves: CVE-2021-21239 Source advisory: OSV:GHSA-5P3X-R448-PC62...

GHSA-5P3X-R448-PC62 Improper Verification of Cryptographic Signature in PySAML2

Impact All users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. pysaml2 = 6.4.1 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the...

raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2021-21239 via pysaml2 (4.6.5)

pysaml2 PYPI version 4.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - raiden =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2021-21239 Source advisory: OSV:GHSA-5P3X-R448-PC62...

Improper Verification of Cryptographic Signature in PySAML2

Impact All users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. pysaml2 = 6.4.1 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the...

satosa (>=0.6.1, <=3.2.1) potentially affected by CVE-2021-21238 via pysaml2 (4.0.3)

pysaml2 PYPI version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - satosa =0.6.1, =3.2.1 Source cves: CVE-2021-21238 Source advisory: OSV:GHSA-F4G9-H89H-JGV9...

django-saml2-auth (>=1.0.2b1, <=1.1.4), django-saml2-auth-custom (>=1.0.0, <=1.0.4) potentially affected by CVE-2021-21238 via pysaml2 (4.0.5)

pysaml2 PYPI version 4.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - django-saml2-auth =1.0.2b1, =1.0.0, =1.0.4 Source cves: CVE-2021-21238 Source advisory: OSV:GHSA-F4G9-H89H-JGV9...

djangosaml2 (0.16.11), irisrelay (1.2.1) +1 more potentially affected by CVE-2021-21238 via pysaml2 (4.4.0)

pysaml2 PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - djangosaml2 0.16.11 - irisrelay 1.2.1 - satosa =3.4.2, =3.4.8 Source cves: CVE-2021-21238 Source advisory: OSV:GHSA-F4G9-H89H-JGV9...

django-saml2-auth-plus (1.0.0), djangosaml2 (0.17.1) +1 more potentially affected by CVE-2021-21238 via pysaml2 (4.5.0)

pysaml2 PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - django-saml2-auth-plus 1.0.0 - djangosaml2 0.17.1 - irisrelay =1.2.2, =1.3.1 Source cves: CVE-2021-21238 Source advisory: OSV:GHSA-F4G9-H89H-JGV9...

raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2021-21238 via pysaml2 (4.6.5)

pysaml2 PYPI version 4.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - raiden =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2021-21238 Source advisory: OSV:GHSA-F4G9-H89H-JGV9...

irisrelay (>=1.1.1, <=1.2.0) potentially affected by CVE-2021-21238 via pysaml2 (4.8.0)

pysaml2 PYPI version 4.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - irisrelay =1.1.1, =1.2.0 Source cves: CVE-2021-21238 Source advisory: OSV:GHSA-F4G9-H89H-JGV9...

django-allauth-saml2 (>=0.1.0, <=0.2.0), django3-auth-saml2 (0.2.0) potentially affected by CVE-2021-21238 via pysaml2 (5.0.0)

pysaml2 PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - django-allauth-saml2 =0.1.0, =0.2.0 - django3-auth-saml2 0.2.0 Source cves: CVE-2021-21238 Source advisory: OSV:GHSA-F4G9-H89H-JGV9...

satosa (>=3.3.1, <=3.4.0) potentially affected by CVE-2021-21238 via pysaml2 (4.2.0)

pysaml2 PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - satosa =3.3.1, =3.4.0 Source cves: CVE-2021-21238 Source advisory: OSV:GHSA-F4G9-H89H-JGV9...

keystone (>=12.0.2, <=13.0.4) potentially affected by CVE-2021-21238 via pysaml2 (4.0.2)

pysaml2 PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - keystone =12.0.2, =13.0.4 Source cves: CVE-2021-21238 Source advisory: OSV:GHSA-F4G9-H89H-JGV9...

GHSA-F4G9-H89H-JGV9 SAML XML Signature wrapping in PySAML2

Impact All users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. pysaml2 = 6.4.1 does not validate the SAML document against an XML schema. This allows invalid XML documents to trick the verification process, by presenting elemen...

SAML XML Signature wrapping in PySAML2

Impact All users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. pysaml2 = 6.4.1 does not validate the SAML document against an XML schema. This allows invalid XML documents to trick the verification process, by presenting elemen...

CVE-2021-21238: Improper Verification of Cryptographic Signature

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping...

CVE-2021-21239: Improper Verification of Cryptographic Signature

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does no...

Idpy Pysaml2 Data Forgery Issue Vulnerability

Idpy Pysaml2 is a Python-based SAML server implementation from the Idpy community. Idpy PySAML2 before 6.5.0 suffers from a data forgery issue vulnerability that stems from a cryptographic signature validation error...