6 matches found
CVE-2026-64855
soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verifyenvelopebsp derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's...
CVE-2026-64855 soapbar: verify_envelope_bsp accepts an unauthenticated embedded certificate (signature forgery / authentication bypass)
soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verifyenvelopebsp derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's...
CVE-2026-64855
soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verifyenvelopebsp derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's...
EUVD-2026-123572
soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verifyenvelopebsp derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's...
CVE-2026-64855
The soapbar Python SOAP library is vulnerable in versions prior to 0.13.0 due to a flaw in the verify_envelope_bsp() function. The vulnerability exists because the function derives its trust anchor directly from the message it verifies, reading an X.509 certificate from the untrusted wsse:BinaryS...
CVE-2026-64855: hitoshyamamoto soapbar: soapbar is a SOAP library for Python — client, server, and WSDL handling
soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verifyenvelopebsp derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's...