Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2016-10149 (GCVE-0-2016-10149)
Vulnerability from cvelistv5
Published
2017-03-24 14:00
Modified
2024-08-06 03:14
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T03:14:42.098Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rohe/pysaml2/issues/366"
},
{
"name": "RHSA-2017:0936",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
},
{
"name": "[oss-security] 20170119 Re: CVE request: python-pysaml2 XML external entity attack",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/19/5"
},
{
"name": "97692",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/97692"
},
{
"name": "DSA-3759",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2017/dsa-3759"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716"
},
{
"name": "RHSA-2017:0938",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/rohe/pysaml2/pull/379"
},
{
"name": "RHSA-2017:0937",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-04T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rohe/pysaml2/issues/366"
},
{
"name": "RHSA-2017:0936",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
},
{
"name": "[oss-security] 20170119 Re: CVE request: python-pysaml2 XML external entity attack",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/19/5"
},
{
"name": "97692",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/97692"
},
{
"name": "DSA-3759",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2017/dsa-3759"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716"
},
{
"name": "RHSA-2017:0938",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rohe/pysaml2/pull/379"
},
{
"name": "RHSA-2017:0937",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-10149",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/rohe/pysaml2/issues/366",
"refsource": "MISC",
"url": "https://github.com/rohe/pysaml2/issues/366"
},
{
"name": "RHSA-2017:0936",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
},
{
"name": "[oss-security] 20170119 Re: CVE request: python-pysaml2 XML external entity attack",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/01/19/5"
},
{
"name": "97692",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/97692"
},
{
"name": "DSA-3759",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2017/dsa-3759"
},
{
"name": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b",
"refsource": "CONFIRM",
"url": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b"
},
{
"name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716",
"refsource": "CONFIRM",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716"
},
{
"name": "RHSA-2017:0938",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
},
{
"name": "https://github.com/rohe/pysaml2/pull/379",
"refsource": "CONFIRM",
"url": "https://github.com/rohe/pysaml2/pull/379"
},
{
"name": "RHSA-2017:0937",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-10149",
"datePublished": "2017-03-24T14:00:00",
"dateReserved": "2017-01-19T00:00:00",
"dateUpdated": "2024-08-06T03:14:42.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2016-10149\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2017-03-24T14:59:00.227\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de XXE en PySAML2 4.4.0 y versiones anteriores permite a atacantes remotos leer archivos arbitrarios a trav\u00e9s de una solicitud o respuesta SAMPL XML manipulada.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-611\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:pysaml2_project:pysaml2:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"4.4.0\",\"matchCriteriaId\":\"24F2FB4E-4F43-4B09-B01C-1B3FCB88AB2C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]}],\"references\":[{\"url\":\"http://www.debian.org/security/2017/dsa-3759\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2017/01/19/5\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/97692\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0936\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0937\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0938\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/rohe/pysaml2/issues/366\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/rohe/pysaml2/pull/379\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2017/dsa-3759\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2017/01/19/5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/97692\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0936\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0937\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0938\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/rohe/pysaml2/issues/366\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/rohe/pysaml2/pull/379\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]}]}}"
}
}
RHSA-2017:0938
Vulnerability from csaf_redhat
Published
2017-04-12 13:49
Modified
2025-11-08 04:29
Summary
Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update
Notes
Topic
An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 10.0 (Newton).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The defusedxml package contains several Python-only updates for security vulnerabilities in Python's XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.
PySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.
Security Fix(es):
* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 10.0 (Newton).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The defusedxml package contains several Python-only updates for security vulnerabilities in Python\u0027s XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.\n\nPySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.\n\nSecurity Fix(es):\n\n* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0938",
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0938.json"
}
],
"title": "Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update",
"tracking": {
"current_release_date": "2025-11-08T04:29:38+00:00",
"generator": {
"date": "2025-11-08T04:29:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2017:0938",
"initial_release_date": "2017-04-12T13:49:43+00:00",
"revision_history": [
{
"date": "2017-04-12T13:49:43+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-12T13:49:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T04:29:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 10.0",
"product": {
"name": "Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:10::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.noarch"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.src"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.noarch"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.src"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10149",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2017-01-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1415710"
}
],
"notes": [
{
"category": "description",
"text": "An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pysaml2: Entity expansion issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-10149"
},
{
"category": "external",
"summary": "RHBZ#1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-10149",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149"
}
],
"release_date": "2016-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-12T13:49:43+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pysaml2: Entity expansion issue"
}
]
}
rhsa-2017_0936
Vulnerability from csaf_redhat
Published
2017-04-12 13:51
Modified
2024-11-14 19:03
Summary
Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update
Notes
Topic
An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 8.0 (Liberty).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The defusedxml package contains several Python-only updates for security vulnerabilities in Python's XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.
PySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.
Security Fix(es):
* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 8.0 (Liberty).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The defusedxml package contains several Python-only updates for security vulnerabilities in Python\u0027s XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.\n\nPySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.\n\nSecurity Fix(es):\n\n* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0936",
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0936.json"
}
],
"title": "Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update",
"tracking": {
"current_release_date": "2024-11-14T19:03:42+00:00",
"generator": {
"date": "2024-11-14T19:03:42+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0936",
"initial_release_date": "2017-04-12T13:51:05+00:00",
"revision_history": [
{
"date": "2017-04-12T13:51:05+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-12T13:51:05+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T19:03:42+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product": {
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:8::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.noarch"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.src"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.noarch"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.src"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10149",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2017-01-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1415710"
}
],
"notes": [
{
"category": "description",
"text": "An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pysaml2: Entity expansion issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-10149"
},
{
"category": "external",
"summary": "RHBZ#1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-10149",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149"
}
],
"release_date": "2016-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-12T13:51:05+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pysaml2: Entity expansion issue"
}
]
}
rhsa-2017_0938
Vulnerability from csaf_redhat
Published
2017-04-12 13:49
Modified
2024-11-14 19:03
Summary
Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update
Notes
Topic
An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 10.0 (Newton).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The defusedxml package contains several Python-only updates for security vulnerabilities in Python's XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.
PySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.
Security Fix(es):
* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 10.0 (Newton).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The defusedxml package contains several Python-only updates for security vulnerabilities in Python\u0027s XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.\n\nPySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.\n\nSecurity Fix(es):\n\n* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0938",
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0938.json"
}
],
"title": "Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update",
"tracking": {
"current_release_date": "2024-11-14T19:03:51+00:00",
"generator": {
"date": "2024-11-14T19:03:51+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0938",
"initial_release_date": "2017-04-12T13:49:43+00:00",
"revision_history": [
{
"date": "2017-04-12T13:49:43+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-12T13:49:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T19:03:51+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 10.0",
"product": {
"name": "Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:10::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.noarch"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.src"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.noarch"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.src"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10149",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2017-01-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1415710"
}
],
"notes": [
{
"category": "description",
"text": "An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pysaml2: Entity expansion issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-10149"
},
{
"category": "external",
"summary": "RHBZ#1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-10149",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149"
}
],
"release_date": "2016-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-12T13:49:43+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pysaml2: Entity expansion issue"
}
]
}
rhsa-2017:0936
Vulnerability from csaf_redhat
Published
2017-04-12 13:51
Modified
2025-11-08 04:29
Summary
Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update
Notes
Topic
An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 8.0 (Liberty).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The defusedxml package contains several Python-only updates for security vulnerabilities in Python's XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.
PySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.
Security Fix(es):
* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 8.0 (Liberty).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The defusedxml package contains several Python-only updates for security vulnerabilities in Python\u0027s XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.\n\nPySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.\n\nSecurity Fix(es):\n\n* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0936",
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0936.json"
}
],
"title": "Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update",
"tracking": {
"current_release_date": "2025-11-08T04:29:37+00:00",
"generator": {
"date": "2025-11-08T04:29:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2017:0936",
"initial_release_date": "2017-04-12T13:51:05+00:00",
"revision_history": [
{
"date": "2017-04-12T13:51:05+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-12T13:51:05+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T04:29:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product": {
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:8::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.noarch"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.src"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.noarch"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.src"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10149",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2017-01-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1415710"
}
],
"notes": [
{
"category": "description",
"text": "An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pysaml2: Entity expansion issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-10149"
},
{
"category": "external",
"summary": "RHBZ#1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-10149",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149"
}
],
"release_date": "2016-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-12T13:51:05+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pysaml2: Entity expansion issue"
}
]
}
RHSA-2017:0936
Vulnerability from csaf_redhat
Published
2017-04-12 13:51
Modified
2025-11-08 04:29
Summary
Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update
Notes
Topic
An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 8.0 (Liberty).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The defusedxml package contains several Python-only updates for security vulnerabilities in Python's XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.
PySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.
Security Fix(es):
* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 8.0 (Liberty).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The defusedxml package contains several Python-only updates for security vulnerabilities in Python\u0027s XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.\n\nPySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.\n\nSecurity Fix(es):\n\n* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0936",
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0936.json"
}
],
"title": "Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update",
"tracking": {
"current_release_date": "2025-11-08T04:29:37+00:00",
"generator": {
"date": "2025-11-08T04:29:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2017:0936",
"initial_release_date": "2017-04-12T13:51:05+00:00",
"revision_history": [
{
"date": "2017-04-12T13:51:05+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-12T13:51:05+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T04:29:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product": {
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:8::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.noarch"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.src"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.noarch"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.src"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10149",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2017-01-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1415710"
}
],
"notes": [
{
"category": "description",
"text": "An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pysaml2: Entity expansion issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-10149"
},
{
"category": "external",
"summary": "RHBZ#1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-10149",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149"
}
],
"release_date": "2016-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-12T13:51:05+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-8.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pysaml2: Entity expansion issue"
}
]
}
RHSA-2017:0937
Vulnerability from csaf_redhat
Published
2017-04-12 13:50
Modified
2025-11-08 04:29
Summary
Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update
Notes
Topic
An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 9.0 (Mitaka).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The defusedxml package contains several Python-only updates for security vulnerabilities in Python's XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.
PySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.
Security Fix(es):
* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 9.0 (Mitaka).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The defusedxml package contains several Python-only updates for security vulnerabilities in Python\u0027s XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.\n\nPySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.\n\nSecurity Fix(es):\n\n* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0937",
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0937.json"
}
],
"title": "Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update",
"tracking": {
"current_release_date": "2025-11-08T04:29:38+00:00",
"generator": {
"date": "2025-11-08T04:29:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2017:0937",
"initial_release_date": "2017-04-12T13:50:14+00:00",
"revision_history": [
{
"date": "2017-04-12T13:50:14+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-12T13:50:14+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T04:29:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 9.0",
"product": {
"name": "Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:9::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.noarch"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.src"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.noarch"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.src"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10149",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2017-01-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1415710"
}
],
"notes": [
{
"category": "description",
"text": "An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pysaml2: Entity expansion issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-10149"
},
{
"category": "external",
"summary": "RHBZ#1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-10149",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149"
}
],
"release_date": "2016-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-12T13:50:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pysaml2: Entity expansion issue"
}
]
}
rhsa-2017:0938
Vulnerability from csaf_redhat
Published
2017-04-12 13:49
Modified
2025-11-08 04:29
Summary
Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update
Notes
Topic
An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 10.0 (Newton).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The defusedxml package contains several Python-only updates for security vulnerabilities in Python's XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.
PySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.
Security Fix(es):
* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 10.0 (Newton).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The defusedxml package contains several Python-only updates for security vulnerabilities in Python\u0027s XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.\n\nPySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.\n\nSecurity Fix(es):\n\n* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0938",
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0938.json"
}
],
"title": "Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update",
"tracking": {
"current_release_date": "2025-11-08T04:29:38+00:00",
"generator": {
"date": "2025-11-08T04:29:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2017:0938",
"initial_release_date": "2017-04-12T13:49:43+00:00",
"revision_history": [
{
"date": "2017-04-12T13:49:43+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-12T13:49:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T04:29:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 10.0",
"product": {
"name": "Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:10::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.noarch"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.src"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.noarch"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.src"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10149",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2017-01-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1415710"
}
],
"notes": [
{
"category": "description",
"text": "An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pysaml2: Entity expansion issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-10149"
},
{
"category": "external",
"summary": "RHBZ#1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-10149",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149"
}
],
"release_date": "2016-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-12T13:49:43+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-10.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pysaml2: Entity expansion issue"
}
]
}
rhsa-2017_0937
Vulnerability from csaf_redhat
Published
2017-04-12 13:50
Modified
2024-11-14 19:03
Summary
Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update
Notes
Topic
An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 9.0 (Mitaka).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The defusedxml package contains several Python-only updates for security vulnerabilities in Python's XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.
PySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.
Security Fix(es):
* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 9.0 (Mitaka).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The defusedxml package contains several Python-only updates for security vulnerabilities in Python\u0027s XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.\n\nPySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.\n\nSecurity Fix(es):\n\n* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0937",
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0937.json"
}
],
"title": "Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update",
"tracking": {
"current_release_date": "2024-11-14T19:03:46+00:00",
"generator": {
"date": "2024-11-14T19:03:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0937",
"initial_release_date": "2017-04-12T13:50:14+00:00",
"revision_history": [
{
"date": "2017-04-12T13:50:14+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-12T13:50:14+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T19:03:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 9.0",
"product": {
"name": "Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:9::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.noarch"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.src"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.noarch"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.src"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10149",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2017-01-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1415710"
}
],
"notes": [
{
"category": "description",
"text": "An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pysaml2: Entity expansion issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-10149"
},
{
"category": "external",
"summary": "RHBZ#1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-10149",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149"
}
],
"release_date": "2016-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-12T13:50:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pysaml2: Entity expansion issue"
}
]
}
rhsa-2017:0937
Vulnerability from csaf_redhat
Published
2017-04-12 13:50
Modified
2025-11-08 04:29
Summary
Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update
Notes
Topic
An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 9.0 (Mitaka).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The defusedxml package contains several Python-only updates for security vulnerabilities in Python's XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.
PySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.
Security Fix(es):
* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 9.0 (Mitaka).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The defusedxml package contains several Python-only updates for security vulnerabilities in Python\u0027s XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.\n\nPySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.\n\nSecurity Fix(es):\n\n* An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0937",
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0937.json"
}
],
"title": "Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update",
"tracking": {
"current_release_date": "2025-11-08T04:29:38+00:00",
"generator": {
"date": "2025-11-08T04:29:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2017:0937",
"initial_release_date": "2017-04-12T13:50:14+00:00",
"revision_history": [
{
"date": "2017-04-12T13:50:14+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-12T13:50:14+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-08T04:29:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 9.0",
"product": {
"name": "Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:9::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_id": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-defusedxml@0.5.0-1.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_id": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysaml2@3.0.2-3.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.noarch as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.noarch"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0:0.5.0-1.el7ost.src as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.src"
},
"product_reference": "python-defusedxml-0:0.5.0-1.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.noarch"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-0:3.0.2-3.el7ost.src as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.src"
},
"product_reference": "python-pysaml2-0:3.0.2-3.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10149",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2017-01-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1415710"
}
],
"notes": [
{
"category": "description",
"text": "An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pysaml2: Entity expansion issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-10149"
},
{
"category": "external",
"summary": "RHBZ#1415710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415710"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-10149",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149"
}
],
"release_date": "2016-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-12T13:50:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-defusedxml-0:0.5.0-1.el7ost.src",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.noarch",
"7Server-RH7-RHOS-9.0:python-pysaml2-0:3.0.2-3.el7ost.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pysaml2: Entity expansion issue"
}
]
}
ghsa-c2vx-49jm-h3f6
Vulnerability from github
Published
2018-07-16 16:50
Modified
2024-10-21 21:08
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
VLAI Severity ?
Summary
Pysaml2 does not sanitize XML responses
Details
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.4.0"
},
"package": {
"ecosystem": "PyPI",
"name": "pysaml2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-10149"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:30:06Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.",
"id": "GHSA-c2vx-49jm-h3f6",
"modified": "2024-10-21T21:08:33Z",
"published": "2018-07-16T16:50:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149"
},
{
"type": "WEB",
"url": "https://github.com/rohe/pysaml2/issues/366"
},
{
"type": "WEB",
"url": "https://github.com/rohe/pysaml2/pull/379"
},
{
"type": "WEB",
"url": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-c2vx-49jm-h3f6"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pysaml2/PYSEC-2017-25.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/rohe/pysaml2"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3759"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/01/19/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Pysaml2 does not sanitize XML responses"
}
pysec-2017-25
Vulnerability from pysec
Published
2017-03-24 14:59
Modified
2021-07-05 00:01
Details
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
Impacted products
| Name | purl | pysaml2 | pkg:pypi/pysaml2 |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pysaml2",
"purl": "pkg:pypi/pysaml2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6e09a25d9b4b7aa7a506853210a9a14100b8bc9b"
}
],
"repo": "https://github.com/rohe/pysaml2",
"type": "GIT"
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.4.3",
"1.0.1",
"1.0.2",
"1.0.3",
"1.1.0",
"2.0.0",
"2.1.0",
"2.2.0",
"2.3.0",
"2.4.0",
"3.0.0",
"3.0.2",
"4.0.0",
"4.0.1",
"4.0.2",
"4.0.3",
"4.0.4",
"4.0.5",
"4.0.5rc1",
"4.1.0",
"4.2.0",
"4.3.0",
"4.4.0"
]
}
],
"aliases": [
"CVE-2016-10149",
"GHSA-c2vx-49jm-h3f6"
],
"details": "XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.",
"id": "PYSEC-2017-25",
"modified": "2021-07-05T00:01:25.139700Z",
"published": "2017-03-24T14:59:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rohe/pysaml2/pull/379"
},
{
"type": "REPORT",
"url": "https://github.com/rohe/pysaml2/issues/366"
},
{
"type": "FIX",
"url": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/01/19/5"
},
{
"type": "ADVISORY",
"url": "http://www.debian.org/security/2017/dsa-3759"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97692"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-c2vx-49jm-h3f6"
}
]
}
cnvd-2017-05308
Vulnerability from cnvd
Title
python-pysaml2 XML外部实体注入漏洞（CNVD-2017-05308）
Description
PySAML2是一个使用python编写的SAML2的实现。
PySAML2 4.4.0及之前的版本中存在XML外部实体注入漏洞。远程攻击者可利用该漏洞通过发送特制的SAMPL XML请求或响应读取任意文件。
Severity
中
VLAI Severity ?
Patch Name
python-pysaml2 XML外部实体注入漏洞（CNVD-2017-05308）的补丁
Patch Description
PySAML2是一个使用python编写的SAML2的实现。
PySAML2 4.4.0及之前的版本中存在XML外部实体注入漏洞。远程攻击者可利用该漏洞通过发送特制的SAMPL XML请求或响应读取任意文件。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b
Reference
https://github.com/rohe/pysaml2/pull/379
https://nvd.nist.gov/vuln/detail/CVE-2016-10149
http://www.securityfocus.com/bid/97692
Impacted products
| Name | rohe pysaml2 <=4.4.0 |
|---|
{
"bids": {
"bid": {
"bidNumber": "97692"
}
},
"cves": {
"cve": {
"cveNumber": "CVE-2016-10149",
"cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10149"
}
},
"description": "PySAML2\u662f\u4e00\u4e2a\u4f7f\u7528python\u7f16\u5199\u7684SAML2\u7684\u5b9e\u73b0\u3002\r\n\r\nPySAML2 4.4.0\u53ca\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d1\u9001\u7279\u5236\u7684SAMPL XML\u8bf7\u6c42\u6216\u54cd\u5e94\u8bfb\u53d6\u4efb\u610f\u6587\u4ef6\u3002",
"discovererName": "FreedomCoder",
"formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2017-05308",
"openTime": "2017-04-25",
"patchDescription": "PySAML2\u662f\u4e00\u4e2a\u4f7f\u7528python\u7f16\u5199\u7684SAML2\u7684\u5b9e\u73b0\u3002\r\n\r\nPySAML2 4.4.0\u53ca\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d1\u9001\u7279\u5236\u7684SAMPL XML\u8bf7\u6c42\u6216\u54cd\u5e94\u8bfb\u53d6\u4efb\u610f\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "python-pysaml2 XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2017-05308\uff09\u7684\u8865\u4e01",
"products": {
"product": "rohe pysaml2 \u003c=4.4.0"
},
"referenceLink": "https://github.com/rohe/pysaml2/pull/379\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-10149\r\nhttp://www.securityfocus.com/bid/97692",
"serverity": "\u4e2d",
"submitTime": "2017-03-28",
"title": "python-pysaml2 XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2017-05308\uff09"
}
suse-su-2017:0569-1
Vulnerability from csaf_suse
Published
2017-02-27 12:58
Modified
2017-02-27 12:58
Summary
Security update for python-pysaml2
Notes
Title of the patch
Security update for python-pysaml2
Description of the patch
This update for python-pysaml2 fixes the following issues:
- CVE-2016-10127 and CVE-2016-10149: XXE (XML external entity) issues
were fixed in python-pysaml2, where external requests to other XML content
could be made by parsing XML files using this SAML2 library. (bsc#1019074)
To fix this bug, the new dependency python-defusedxml was added and is used for sanitizing XML content.
Patchnames
SUSE-OpenStack-Cloud-6-2017-298
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-pysaml2",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for python-pysaml2 fixes the following issues:\n\n- CVE-2016-10127 and CVE-2016-10149: XXE (XML external entity) issues\n were fixed in python-pysaml2, where external requests to other XML content\n could be made by parsing XML files using this SAML2 library. (bsc#1019074)\n\n To fix this bug, the new dependency python-defusedxml was added and is used for sanitizing XML content.\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-OpenStack-Cloud-6-2017-298",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_0569-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2017:0569-1",
"url": "https://www.suse.com/support/update/announcement/2017/suse-su-20170569-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2017:0569-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2017-February/002665.html"
},
{
"category": "self",
"summary": "SUSE Bug 1019074",
"url": "https://bugzilla.suse.com/1019074"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-10127 page",
"url": "https://www.suse.com/security/cve/CVE-2016-10127/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-10149 page",
"url": "https://www.suse.com/security/cve/CVE-2016-10149/"
}
],
"title": "Security update for python-pysaml2",
"tracking": {
"current_release_date": "2017-02-27T12:58:27Z",
"generator": {
"date": "2017-02-27T12:58:27Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2017:0569-1",
"initial_release_date": "2017-02-27T12:58:27Z",
"revision_history": [
{
"date": "2017-02-27T12:58:27Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-defusedxml-0.4.1-2.1.noarch",
"product": {
"name": "python-defusedxml-0.4.1-2.1.noarch",
"product_id": "python-defusedxml-0.4.1-2.1.noarch"
}
},
{
"category": "product_version",
"name": "python-pysaml2-2.4.0-3.1.noarch",
"product": {
"name": "python-pysaml2-2.4.0-3.1.noarch",
"product_id": "python-pysaml2-2.4.0-3.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 6",
"product": {
"name": "SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud:6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-defusedxml-0.4.1-2.1.noarch as component of SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6:python-defusedxml-0.4.1-2.1.noarch"
},
"product_reference": "python-defusedxml-0.4.1-2.1.noarch",
"relates_to_product_reference": "SUSE OpenStack Cloud 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysaml2-2.4.0-3.1.noarch as component of SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6:python-pysaml2-2.4.0-3.1.noarch"
},
"product_reference": "python-pysaml2-2.4.0-3.1.noarch",
"relates_to_product_reference": "SUSE OpenStack Cloud 6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10127",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-10127"
}
],
"notes": [
{
"category": "general",
"text": "PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 6:python-defusedxml-0.4.1-2.1.noarch",
"SUSE OpenStack Cloud 6:python-pysaml2-2.4.0-3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-10127",
"url": "https://www.suse.com/security/cve/CVE-2016-10127"
},
{
"category": "external",
"summary": "SUSE Bug 1019074 for CVE-2016-10127",
"url": "https://bugzilla.suse.com/1019074"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 6:python-defusedxml-0.4.1-2.1.noarch",
"SUSE OpenStack Cloud 6:python-pysaml2-2.4.0-3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE OpenStack Cloud 6:python-defusedxml-0.4.1-2.1.noarch",
"SUSE OpenStack Cloud 6:python-pysaml2-2.4.0-3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-02-27T12:58:27Z",
"details": "important"
}
],
"title": "CVE-2016-10127"
},
{
"cve": "CVE-2016-10149",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-10149"
}
],
"notes": [
{
"category": "general",
"text": "XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 6:python-defusedxml-0.4.1-2.1.noarch",
"SUSE OpenStack Cloud 6:python-pysaml2-2.4.0-3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-10149",
"url": "https://www.suse.com/security/cve/CVE-2016-10149"
},
{
"category": "external",
"summary": "SUSE Bug 1019074 for CVE-2016-10149",
"url": "https://bugzilla.suse.com/1019074"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 6:python-defusedxml-0.4.1-2.1.noarch",
"SUSE OpenStack Cloud 6:python-pysaml2-2.4.0-3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE OpenStack Cloud 6:python-defusedxml-0.4.1-2.1.noarch",
"SUSE OpenStack Cloud 6:python-pysaml2-2.4.0-3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-02-27T12:58:27Z",
"details": "important"
}
],
"title": "CVE-2016-10149"
}
]
}
fkie_cve-2016-10149
Vulnerability from fkie_nvd
Published
2017-03-24 14:59
Modified
2025-04-20 01:37
Severity ?
Summary
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | http://www.debian.org/security/2017/dsa-3759 | Third Party Advisory | |
| cve@mitre.org | http://www.openwall.com/lists/oss-security/2017/01/19/5 | Mailing List, Patch, Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/97692 | ||
| cve@mitre.org | https://access.redhat.com/errata/RHSA-2017:0936 | ||
| cve@mitre.org | https://access.redhat.com/errata/RHSA-2017:0937 | ||
| cve@mitre.org | https://access.redhat.com/errata/RHSA-2017:0938 | ||
| cve@mitre.org | https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716 | Issue Tracking, Patch, Third Party Advisory | |
| cve@mitre.org | https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b | Issue Tracking, Patch, Third Party Advisory | |
| cve@mitre.org | https://github.com/rohe/pysaml2/issues/366 | Issue Tracking, Patch, Third Party Advisory | |
| cve@mitre.org | https://github.com/rohe/pysaml2/pull/379 | Issue Tracking, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2017/dsa-3759 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2017/01/19/5 | Mailing List, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/97692 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://access.redhat.com/errata/RHSA-2017:0936 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://access.redhat.com/errata/RHSA-2017:0937 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://access.redhat.com/errata/RHSA-2017:0938 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716 | Issue Tracking, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b | Issue Tracking, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/rohe/pysaml2/issues/366 | Issue Tracking, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/rohe/pysaml2/pull/379 | Issue Tracking, Patch, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| pysaml2_project | pysaml2 | * | |
| debian | debian_linux | 8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pysaml2_project:pysaml2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "24F2FB4E-4F43-4B09-B01C-1B3FCB88AB2C",
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response."
},
{
"lang": "es",
"value": "Vulnerabilidad de XXE en PySAML2 4.4.0 y versiones anteriores permite a atacantes remotos leer archivos arbitrarios a trav\u00e9s de una solicitud o respuesta SAMPL XML manipulada."
}
],
"id": "CVE-2016-10149",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-03-24T14:59:00.227",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2017/dsa-3759"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/19/5"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/97692"
},
{
"source": "cve@mitre.org",
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
},
{
"source": "cve@mitre.org",
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
},
{
"source": "cve@mitre.org",
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/rohe/pysaml2/issues/366"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/rohe/pysaml2/pull/379"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2017/dsa-3759"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/19/5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/97692"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/rohe/pysaml2/issues/366"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/rohe/pysaml2/pull/379"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-611"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
gsd-2016-10149
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2016-10149",
"description": "XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.",
"id": "GSD-2016-10149",
"references": [
"https://www.suse.com/security/cve/CVE-2016-10149.html",
"https://www.debian.org/security/2017/dsa-3759",
"https://access.redhat.com/errata/RHSA-2017:0938",
"https://access.redhat.com/errata/RHSA-2017:0937",
"https://access.redhat.com/errata/RHSA-2017:0936",
"https://ubuntu.com/security/CVE-2016-10149"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2016-10149"
],
"details": "XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.",
"id": "GSD-2016-10149",
"modified": "2023-12-13T01:21:26.361322Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-10149",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/rohe/pysaml2/issues/366",
"refsource": "MISC",
"url": "https://github.com/rohe/pysaml2/issues/366"
},
{
"name": "RHSA-2017:0936",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
},
{
"name": "[oss-security] 20170119 Re: CVE request: python-pysaml2 XML external entity attack",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/01/19/5"
},
{
"name": "97692",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/97692"
},
{
"name": "DSA-3759",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2017/dsa-3759"
},
{
"name": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b",
"refsource": "CONFIRM",
"url": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b"
},
{
"name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716",
"refsource": "CONFIRM",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716"
},
{
"name": "RHSA-2017:0938",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
},
{
"name": "https://github.com/rohe/pysaml2/pull/379",
"refsource": "CONFIRM",
"url": "https://github.com/rohe/pysaml2/pull/379"
},
{
"name": "RHSA-2017:0937",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c=4.4.0",
"affected_versions": "All versions up to 4.4.0",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-611",
"CWE-937"
],
"date": "2021-09-08",
"description": "XML External Entity vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.",
"fixed_versions": [
"4.5.0"
],
"identifier": "CVE-2016-10149",
"identifiers": [
"GHSA-c2vx-49jm-h3f6",
"CVE-2016-10149"
],
"not_impacted": "All versions after 4.4.0",
"package_slug": "pypi/pysaml2",
"pubdate": "2018-07-16",
"solution": "Upgrade to version 4.5.0 or above.",
"title": "Improper Restriction of XML External Entity Reference",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2016-10149",
"https://github.com/rohe/pysaml2/issues/366",
"https://github.com/rohe/pysaml2/pull/379",
"https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b",
"https://access.redhat.com/errata/RHSA-2017:0936",
"https://access.redhat.com/errata/RHSA-2017:0937",
"https://access.redhat.com/errata/RHSA-2017:0938",
"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716",
"https://github.com/advisories/GHSA-c2vx-49jm-h3f6",
"http://www.debian.org/security/2017/dsa-3759",
"http://www.openwall.com/lists/oss-security/2017/01/19/5",
"http://www.securityfocus.com/bid/97692"
],
"uuid": "48530af7-611b-4b55-b608-78d7bcf9674d"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:pysaml2_project:pysaml2:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-10149"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-611"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/rohe/pysaml2/pull/379",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/rohe/pysaml2/pull/379"
},
{
"name": "https://github.com/rohe/pysaml2/issues/366",
"refsource": "MISC",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/rohe/pysaml2/issues/366"
},
{
"name": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b"
},
{
"name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716"
},
{
"name": "[oss-security] 20170119 Re: CVE request: python-pysaml2 XML external entity attack",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/19/5"
},
{
"name": "DSA-3759",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2017/dsa-3759"
},
{
"name": "97692",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/97692"
},
{
"name": "RHSA-2017:0938",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
},
{
"name": "RHSA-2017:0937",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
},
{
"name": "RHSA-2017:0936",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
},
"lastModifiedDate": "2018-01-05T02:30Z",
"publishedDate": "2017-03-24T14:59Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…