CVE-2021-21238
Summary
| CVE | CVE-2021-21238 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-01-21 15:15:00 UTC |
|---|
| Updated | 2021-01-29 17:58:00 UTC |
|---|
| Description | PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| pysaml2 · PyPI |
MISC |
pypi.org |
Product, Third Party Advisory |
| Processing of invalid SAML XML documents · Advisory · IdentityPython/pysaml2 · GitHub |
CONFIRM |
github.com |
Third Party Advisory |
| Merge pull request from GHSA-f4g9-h89h-jgv9 · IdentityPython/pysaml2@1d8fd26 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Release Version 6.5.0 · IdentityPython/pysaml2 · GitHub |
MISC |
github.com |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 179845 Debian Security Update for python-pysaml2 (CVE-2021-21238)
- 501905 Alpine Linux Security Update for py3-saml2
- 690445 Free Berkeley Software Distribution (FreeBSD) Security Update for pysaml2 (fb67567a-5d95-11eb-a955-08002728f74c)
- 982964 Python (pip) Security Update for pysaml2 (GHSA-f4g9-h89h-jgv9)
