PT-2017-7752 · Pysaml2+1 · Pysaml2+1

Fruechel · Publicado 2017-01-12 · Atualizado 2022-05-17 · CVE-2016-10127

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions PySAML2 (affected versions not specified)

Description The issue allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2016-10127

DSA-3759-1

GHSA-M269-WJ6G-C459

PYSEC-2017-67

SUSE-SU-2017:0569-1

SUSE-SU-2019:2671-1

SUSE-SU-2019:2867-1

Produtos afetados

Debian

Pysaml2

Referências · 122

• https://github.com/rohe/pysaml2/issues/366 · Correção
• https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b · Correção
• https://github.com/rohe/pysaml2/pull/379 · Correção
• https://github.com/rohe/pysaml2 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pysaml2/PYSEC-2017-67.yaml · Nota
• https://suse.com/security/cve/CVE-2016-10127 · Nota
• https://bugzilla.suse.com/1141676 · Nota
• https://bugzilla.suse.com/1133719 · Nota
• https://bugzilla.suse.com/SOC-10092 · Nota
• https://bugzilla.suse.com/SOC-10001 · Nota
• https://bugzilla.suse.com/SOC-9980 · Nota
• https://bugzilla.suse.com/1145867 · Nota
• https://github.com/advisories/GHSA-m269-wj6g-c459 · Nota
• https://bugzilla.suse.com/SOC-9799 · Nota
• https://bugzilla.suse.com/1145796 · Nota