PT-2017-7771 · Pysaml2+1 · Pysaml2+1

Fruechel · Publicado 2017-01-12 · Atualizado 2018-07-16 · CVE-2016-10149

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PySAML2 versions 4.4.0 and earlier

Description The issue allows remote attackers to read arbitrary files via a crafted SAML XML request or response. This is due to an XML External Entity (XXE) vulnerability.

Recommendations For PySAML2 versions 4.4.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2016-10149

DSA-3759-1

GHSA-C2VX-49JM-H3F6

PYSEC-2017-25

RHSA-2017:0936

RHSA-2017:0937

RHSA-2017:0938

SUSE-SU-2017:0569-1

USN-3402-1

Produtos afetados

Pysaml2

Ubuntu

Referências · 30

• https://github.com/rohe/pysaml2/issues/366 · Correção
• https://github.com/rohe/pysaml2/pull/379 · Correção
• https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b · Correção
• https://github.com/rohe/pysaml2 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pysaml2/PYSEC-2017-25.yaml · Nota
• https://suse.com/security/cve/CVE-2016-10127 · Nota
• https://cve.org/CVERecord?id=CVE-2016-10149 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2017:0936 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:0938 · Aviso do Fabricante
• http://securityfocus.com/bid/97692 · Nota
• https://osv.dev/vulnerability/CVE-2016-10149 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2017-25 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2017/01/19/5 · Correção
• https://access.redhat.com/errata/RHSA-2017:0937 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10149 · Nota de Segurança