PT-2021-8018

Name of the Vulnerable Software and Affected Versions PySAML2 versions prior to 6.5.0 Description The issue is related to an improper verification of cryptographic signatures, specifically a variant of XML Signature wrapping. This occurs because PySAML2 does not validate SAML documents against an...

pysaml2 -- multiple vulnerabilities

pysaml2 Releases: Fix processing of invalid SAML XML documents - CVE-2021-21238 Fix unspecified xmlsec1 key-type preference - CVE-2021-21239...

SAML2 Authentication Library Signature Verification Bypass

The vulnerability of the authentication library for exchanging identification data according to the SAML2 standard, implemented with PySAML2, is related to incorrect verification of the cryptographic signature of the data. Exploiting this vulnerability could allow a malicious actor to bypass the...

SUSE-SU-2020:3897-1 Security update for ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, openstack-heat, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, python-Jinja2, python-pysaml2, python-pytest, python-urllib3, release-notes-suse-openstack-cloud, spark

This update for ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, openstack-heat, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-ironic-python-agent, openstack-manila,...

djangosaml2 (0.16.11), irisrelay (1.2.1) +1 more potentially affected by CVE-2020-5390 via pysaml2 (4.4.0)

pysaml2 PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - djangosaml2 0.16.11 - irisrelay 1.2.1 - satosa =3.4.2, =3.4.8 Source cves: CVE-2020-5390 Source advisory: OSV:GHSA-QF7V-8HJ3-4XW7...

keystone (>=12.0.2, <=13.0.4) potentially affected by CVE-2020-5390 via pysaml2 (4.0.2)

pysaml2 PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - keystone =12.0.2, =13.0.4 Source cves: CVE-2020-5390 Source advisory: OSV:GHSA-QF7V-8HJ3-4XW7...

Improper Verification of Cryptographic Signature in PySAML2

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2020-5390 via pysaml2 (4.6.5)

pysaml2 PYPI version 4.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - raiden =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2020-5390 Source advisory: OSV:GHSA-QF7V-8HJ3-4XW7...

satosa (>=0.6.1, <=3.2.1) potentially affected by CVE-2020-5390 via pysaml2 (4.0.3)

pysaml2 PYPI version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - satosa =0.6.1, =3.2.1 Source cves: CVE-2020-5390 Source advisory: OSV:GHSA-QF7V-8HJ3-4XW7...

satosa (>=3.3.1, <=3.4.0) potentially affected by CVE-2020-5390 via pysaml2 (4.2.0)

pysaml2 PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - satosa =3.3.1, =3.4.0 Source cves: CVE-2020-5390 Source advisory: OSV:GHSA-QF7V-8HJ3-4XW7...

GHSA-QF7V-8HJ3-4XW7 Improper Verification of Cryptographic Signature in PySAML2

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

django-saml2-auth-plus (1.0.0), djangosaml2 (0.17.1) +1 more potentially affected by CVE-2020-5390 via pysaml2 (4.5.0)

pysaml2 PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - django-saml2-auth-plus 1.0.0 - djangosaml2 0.17.1 - irisrelay =1.2.2, =1.3.1 Source cves: CVE-2020-5390 Source advisory: OSV:GHSA-QF7V-8HJ3-4XW7...

django-saml2-auth (>=1.0.2b1, <=1.1.4), django-saml2-auth-custom (>=1.0.0, <=1.0.4) potentially affected by CVE-2020-5390 via pysaml2 (4.0.5)

pysaml2 PYPI version 4.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - django-saml2-auth =1.0.2b1, =1.0.0, =1.0.4 Source cves: CVE-2020-5390 Source advisory: OSV:GHSA-QF7V-8HJ3-4XW7...

irisrelay (>=1.1.1, <=1.2.0) potentially affected by CVE-2020-5390 via pysaml2 (4.8.0)

pysaml2 PYPI version 4.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - irisrelay =1.1.1, =1.2.0 Source cves: CVE-2020-5390 Source advisory: OSV:GHSA-QF7V-8HJ3-4XW7...

Debian DLA-2119-1 : python-pysaml2 security update

It was discovered that pysaml2, a Python implementation of SAML to be used in a WSGI environment, was susceptible to XML signature wrapping attacks, which could result in a bypass of signature verification. For Debian 8 'Jessie', this problem has been fixed in version 2.0.0-1+deb8u3. We recommend...

Debian: Security Advisory (DLA-2119-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2119-1] python-pysaml2 security update

Package : python-pysaml2 Version : 2.0.0-1+deb8u3 CVE ID : CVE-2020-5390 Debian Bug : 949322 It was discovered that pysaml2, a Python implementation of SAML to be used in a WSGI environment, was susceptible to XML signature wrapping attacks, which could result in a bypass of signature verificatio...

DLA-2119-1 python-pysaml2 - security update

Bulletin has no description...

Debian DSA-4630-1 : python-pysaml2 - security update

It was discovered that pysaml2, a Python implementation of SAML to be used in a WSGI environment, was susceptible to XML signature wrapping attacks, which could result in a bypass of signature verification. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin we...

Debian: Security Advisory (DSA-4630-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...