[SECURITY] [DSA 3759-1] python-pysaml2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3759-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 12, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3759-1] python-pysaml2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3759-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 12, 2017 https://www.debian.org/security/faq -...

DSA-3759-1 python-pysaml2 - security update

Bulletin has no description...

Debian Security Advisory DSA 3759-1 (python-pysaml2 - security update)

Matias P. Brutti discovered that python-pysaml2, a Python implementation of the Security Assertion Markup Language 2.0, did not correctly sanitize the XML messages it handled. This allowed a remote attacker to perform XML External Entity attacks, leading to a wide range of exploits. OpenVAS...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

Debian: Security Advisory (DSA-3759-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Information Disclosure

pysaml2 is vulnerable to information disclosure. After opening a file, the library does not close the filereader, allowing file descriptors to possibly leak...

Sanity Check Bypass

PySAML2 is vulnerable to sanity bypass. By failing a check and not causing an exception, malicious attackers can bypass all future checks. These checks can be failed by setting a wrong value for the destination or using a mismatched response ID...

XML External Entity (XXE)

PySAML2 is vulnerable to XML external entity attacks XXE. The library does not look for SAML XML requests or responses resulting in the ability to attack...