15 matches found
CVE-2021-21239-Exploit
Detail report below https://docs.google.com/document/d/157fGn7lLP1uBuRz8zUgRDWTDklKznljeOWwRQ-C6uFg/edit?usp=sharing Usage python main.py...
redash-vulnerable
redash-vulnerable 🐛 A Dockerized Redash instance that is vulnerable to CVE-2021-21239 as written about by Calif. Usage 💻 Starting the server preserving data script/server This will start the Redash server using Docker Compose in detached mode, preserving any existing data. The server will be...
CVE-2021-21239
CVE-2021-21239 This is a poc script to explot the xmlsec vulnerability CVE-2021-21239 To use this script you can either build the docker image or you can provide an rsa key yourself and run it assuming you have xmlsec installed Vulnerability info:...
python313-pysaml2-7.5.4-1.1 on GA media (moderate)
python313-pysaml2-7.5.4-1.1 on GA media Announcement ID: openSUSE-SU-2026:11524-1 Rating: moderate Cross-References: CVE-2020-5390 CVE-2021-21238 CVE-2021-21239 CVSS scores: CVE-2020-5390 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-21238 SUSE : 6.5...
Exploit for Improper Verification of Cryptographic Signature in Pysaml2_Project Pysaml2
CVE-2021-21239 This is a poc script to explot the xmlsec vu...
SUSE CVE-2021-21239
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does no...
Ubuntu: Security Advisory (USN-5066-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 16.04 ESM : PySAML2 vulnerability (USN-5066-2)
The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5066-2 advisory. USN-5066-1 fixed a vulnerability in PySAML2. This update provides the corresponding update for Ubuntu 16.04 ESM. Tenable has extracted the preceding description...
Ubuntu: Security Advisory (USN-5066-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 18.04 LTS / 20.04 LTS : PySAML2 vulnerability (USN-5066-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5066-1 advisory. Brian Wolff discovered that PySAML2 incorrectly validated cryptographic signatures. A remote attacker could possibly use this issue to alter SAML...
Debian DLA-2577-1 : python-pysaml2 security update
Several issues have been found in python-pysaml2, a pure python implementation of SAML Version 2 Standard. CVE-2017-1000433 pysaml2 accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password. CVE-2021-21239 pysaml2 ha...
Debian: Security Advisory (DLA-2577-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
django-saml2-auth-plus (1.0.0), djangosaml2 (0.17.1) +1 more potentially affected by CVE-2021-21239 via pysaml2 (4.5.0)
pysaml2 PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - django-saml2-auth-plus 1.0.0 - djangosaml2 0.17.1 - irisrelay =1.2.2, =1.3.1 Source cves: CVE-2021-21239 Source advisory: OSV:PYSEC-2021-49...
CVE-2021-21239
CVE-2021-21239 affects PySAML2 (pre-6.5.0) and stems from improper verification of SAML signatures when using the default CryptoBackendXmlSec1 backend. The underlying xmlsec1 verification can accept arbitrary keys embedded in the document instead of restricting to trusted IdP certificates, enabli...
