CVE-2021-21239
published 2021-01-21CVE-2021-21239: PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability…
PriorityP431medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
1.18%
64.5th percentile
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | python-pysaml2 | < python-pysaml2 6.5.1-1 (bookworm) | python-pysaml2 6.5.1-1 (bookworm) |
| identitypython | pysaml2 | < 6.5.0 | 6.5.0 |
| pysaml2_project | pysaml2 | < 6.5.0 | 6.5.0 |
| pysaml2_project | pysaml2 | >= 0 < 6.5.0 | 6.5.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper Verification of Cryptographic Signature in PySAML2
osv·2021-01-21
CVE-2021-21239 [MEDIUM] Improper Verification of Cryptographic Signature in PySAML2
Improper Verification of Cryptographic Signature in PySAML2
### Impact
All users of pysaml2 that use the default `CryptoBackendXmlSec1` backend and need to verify signed SAML documents are impacted. `pysaml2 <= 6.4.1` does not ensure that a signed SAML document is correctly signed. The default `CryptoBackendXmlSec1` backend is using the `xmlsec1` binary to verify the signature of signed SAML documents, but by default, `xmlsec1` accepts any type of key found within the given document. `xmlsec1` needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature.
### Patches
Users should upgrade to pysaml2 `v6.5.0`.
### Workarounds
No workaround provided at this point.
### References
This issue has been reported in the pa
OSV
CVE-2021-21239: PySAML2 is a pure python implementation of SAML Version 2 Standard
osv·2021-01-21·CVSS 6.5
CVE-2021-21239 [MEDIUM] CVE-2021-21239: PySAML2 is a pure python implementation of SAML Version 2 Standard
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0.
GHSA
Improper Verification of Cryptographic Signature in PySAML2
ghsa·2021-01-21
CVE-2021-21239 [MEDIUM] CWE-347 Improper Verification of Cryptographic Signature in PySAML2
Improper Verification of Cryptographic Signature in PySAML2
### Impact
All users of pysaml2 that use the default `CryptoBackendXmlSec1` backend and need to verify signed SAML documents are impacted. `pysaml2 <= 6.4.1` does not ensure that a signed SAML document is correctly signed. The default `CryptoBackendXmlSec1` backend is using the `xmlsec1` binary to verify the signature of signed SAML documents, but by default, `xmlsec1` accepts any type of key found within the given document. `xmlsec1` needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature.
### Patches
Users should upgrade to pysaml2 `v6.5.0`.
### Workarounds
No workaround provided at this point.
### References
This issue has been reported in the pa
Ubuntu
PySAML2 vulnerability
vendor_ubuntu·2021-09-08
CVE-2021-21239 PySAML2 vulnerability
Title: PySAML2 vulnerability
Summary: PySAML2 could be made to accept invalid SAML documents.
USN-5066-1 fixed a vulnerability in PySAML2. This update provides
the corresponding update for Ubuntu 16.04 ESM.
Original advisory details:
Brian Wolff discovered that PySAML2 incorrectly validated cryptographic
signatures. A remote attacker could possibly use this issue to alter SAML
documents.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
PySAML2 vulnerability
vendor_ubuntu·2021-09-08
CVE-2021-21239 PySAML2 vulnerability
Title: PySAML2 vulnerability
Summary: PySAML2 could be made to accept invalid SAML documents.
Brian Wolff discovered that PySAML2 incorrectly validated cryptographic
signatures. A remote attacker could possibly use this issue to alter SAML
documents.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-pysaml2: An improper verification of cryptographic signature
vendor_redhat·2021-01-21·CVSS 6.5
CVE-2021-21239 [MEDIUM] CWE-347 python-pysaml2: An improper verification of cryptographic signature
python-pysaml2: An improper verification of cryptographic signature
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0.
A ve
Debian
CVE-2021-21239: python-pysaml2 - PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 befo...
vendor_debian·2021·CVSS 6.5
CVE-2021-21239 [MEDIUM] CVE-2021-21239: python-pysaml2 - PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 befo...
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0.
Scope: local
bookworm: resolved (fixed in 6.5.1-1)
bullseye: resolved (fix
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/IdentityPython/pysaml2/commit/46578df0695269a16f1c94171f1429873f90ed99https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-5p3x-r448-pc62https://lists.debian.org/debian-lts-announce/2021/02/msg00038.htmlhttps://pypi.org/project/pysaml2https://www.aleksey.com/pipermail/xmlsec/2013/009717.htmlhttps://github.com/IdentityPython/pysaml2/commit/46578df0695269a16f1c94171f1429873f90ed99https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-5p3x-r448-pc62https://lists.debian.org/debian-lts-announce/2021/02/msg00038.htmlhttps://pypi.org/project/pysaml2https://www.aleksey.com/pipermail/xmlsec/2013/009717.html
2021-01-21
Published