Vulnerability-Lookup

CVE-2017-1000433 (GCVE-0-2017-1000433)

Vulnerability from cvelistv5 – Published: 2018-01-02 23:00 – Updated: 2024-08-05 22:00

Summary

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Assigner

mitre mitre root

References

4 references

URL	Tags
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://github.com/rohe/pysaml2/issues/451	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201801-11	vendor-advisoryx_refsource_GENTOO
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Date Public

2017-09-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:00:41.084Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20180701 [SECURITY] [DLA 1410-1] python-pysaml2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/rohe/pysaml2/issues/451"
          },
          {
            "name": "GLSA-201801-11",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201801-11"
          },
          {
            "name": "[debian-lts-announce] 20210226 [SECURITY] [DLA 2577-1] python-pysaml2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2017-12-29T00:00:00.000Z",
      "datePublic": "2017-09-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-02-26T06:06:17.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20180701 [SECURITY] [DLA 1410-1] python-pysaml2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rohe/pysaml2/issues/451"
        },
        {
          "name": "GLSA-201801-11",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201801-11"
        },
        {
          "name": "[debian-lts-announce] 20210226 [SECURITY] [DLA 2577-1] python-pysaml2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2017-12-29",
          "ID": "CVE-2017-1000433",
          "REQUESTER": "predrag.gruevski@gmail.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20180701 [SECURITY] [DLA 1410-1] python-pysaml2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html"
            },
            {
              "name": "https://github.com/rohe/pysaml2/issues/451",
              "refsource": "CONFIRM",
              "url": "https://github.com/rohe/pysaml2/issues/451"
            },
            {
              "name": "GLSA-201801-11",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201801-11"
            },
            {
              "name": "[debian-lts-announce] 20210226 [SECURITY] [DLA 2577-1] python-pysaml2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-1000433",
    "datePublished": "2018-01-02T23:00:00.000Z",
    "dateReserved": "2018-01-02T00:00:00.000Z",
    "dateUpdated": "2024-08-05T22:00:41.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2017-1000433",
      "date": "2026-09-25",
      "epss": "0.02541",
      "percentile": "0.84323"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:pysaml2_project:pysaml2:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "24F2FB4E-4F43-4B09-B01C-1B3FCB88AB2C",
                  "versionEndIncluding": "4.4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password."
        },
        {
          "lang": "es",
          "value": "pysaml2, en su versi\u00f3n 4.4.0 y anteriores, acepta cualquier contrase\u00f1a cuando se ejecuta con las optimizaciones de python habilitadas. Esto permite que atacantes inicien sesi\u00f3n como cualquier usuario sin conocer su contrase\u00f1a."
        }
      ],
      "id": "CVE-2017-1000433",
      "lastModified": "2024-11-21T03:04:44.003",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "MEDIUM",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 6.8,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 8.6,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 2.2,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2018-01-02T23:29:00.337",
      "references": [
        {
          "source": "cve@mitre.org",
          "tags": [
            "Patch",
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "https://github.com/rohe/pysaml2/issues/451"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Issue Tracking",
            "Third Party Advisory"
          ],
          "url": "https://security.gentoo.org/glsa/201801-11"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "https://github.com/rohe/pysaml2/issues/451"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Issue Tracking",
            "Third Party Advisory"
          ],
          "url": "https://security.gentoo.org/glsa/201801-11"
        }
      ],
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-287"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:pysaml2_project:pysaml2:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "24F2FB4E-4F43-4B09-B01C-1B3FCB88AB2C",
                    "versionEndIncluding": "4.4.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password."
          },
          {
            "lang": "es",
            "value": "pysaml2, en su versi\u00f3n 4.4.0 y anteriores, acepta cualquier contrase\u00f1a cuando se ejecuta con las optimizaciones de python habilitadas. Esto permite que atacantes inicien sesi\u00f3n como cualquier usuario sin conocer su contrase\u00f1a."
          }
        ],
        "id": "CVE-2017-1000433",
        "lastModified": "2024-11-21T03:04:44.003",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 6.8,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2018-01-02T23:29:00.337",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "https://github.com/rohe/pysaml2/issues/451"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://security.gentoo.org/glsa/201801-11"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "https://github.com/rohe/pysaml2/issues/451"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://security.gentoo.org/glsa/201801-11"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T16:36:03+00:00",
      "cve": "CVE-2017-1000433",
      "id": "CVE-2017-1000433",
      "initial_release_date": "2017-09-10T00:00:00+00:00",
      "product_status:known_affected": "10",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "python-pysaml2: Access restriction bypass",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-1000433.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2025-04-25T07:28:18Z",
      "cve": "CVE-2017-1000433",
      "id": "CVE-2017-1000433",
      "initial_release_date": "2023-02-15T04:34:56Z",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "26",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2017-1000433",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2017-1000433.json",
      "version": "7"
    }
  }
}

CNVD-2018-02432

Vulnerability from cnvd - Published: 2018-01-31

Title

PySAML2密码接受漏洞

Description

PySAML2是一个使用python编写的SAML2的实现。 PySAML2 4.4.0及之前的版本中存在安全漏洞，该漏洞源于程序接收任意的密码。攻击者可利用该漏洞以任意用户身份登录。

Severity

中

Patch Name

PySAML2密码接受漏洞的补丁

Patch Description

PySAML2是一个使用python编写的SAML2的实现。 PySAML2 4.4.0及之前的版本中存在安全漏洞，该漏洞源于程序接收任意的密码。攻击者可利用该漏洞以任意用户身份登录。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/rohe/pysaml2

Reference

https://github.com/rohe/pysaml2/issues/451

Impacted products

Name
PySAML2 PySAML2 <=4.4.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-1000433"
    }
  },
  "description": "PySAML2\u662f\u4e00\u4e2a\u4f7f\u7528python\u7f16\u5199\u7684SAML2\u7684\u5b9e\u73b0\u3002\r\n\r\nPySAML2 4.4.0\u53ca\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u63a5\u6536\u4efb\u610f\u7684\u5bc6\u7801\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u4efb\u610f\u7528\u6237\u8eab\u4efd\u767b\u5f55\u3002",
  "discovererName": "unknwon",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/rohe/pysaml2",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-02432",
  "openTime": "2018-01-31",
  "patchDescription": "PySAML2\u662f\u4e00\u4e2a\u4f7f\u7528python\u7f16\u5199\u7684SAML2\u7684\u5b9e\u73b0\u3002\r\n\r\nPySAML2 4.4.0\u53ca\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u63a5\u6536\u4efb\u610f\u7684\u5bc6\u7801\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u4efb\u610f\u7528\u6237\u8eab\u4efd\u767b\u5f55\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "PySAML2\u5bc6\u7801\u63a5\u53d7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "PySAML2 PySAML2 \u003c=4.4.0"
  },
  "referenceLink": "https://github.com/rohe/pysaml2/issues/451",
  "serverity": "\u4e2d",
  "submitTime": "2018-01-03",
  "title": "PySAML2\u5bc6\u7801\u63a5\u53d7\u6f0f\u6d1e"
}

FKIE_CVE-2017-1000433

Vulnerability from fkie_nvd - Published: 2018-01-02 23:29 - Updated: 2026-06-17 00:59

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.

References

URL	Tags
cve@mitre.org	https://github.com/rohe/pysaml2/issues/451	Patch, Third Party Advisory, VDB Entry
cve@mitre.org	https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html	Mailing List, Third Party Advisory
cve@mitre.org	https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html	Mailing List, Third Party Advisory
cve@mitre.org	https://security.gentoo.org/glsa/201801-11	Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/rohe/pysaml2/issues/451	Patch, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.gentoo.org/glsa/201801-11	Issue Tracking, Third Party Advisory

Impacted products

Vendor	Product	Version
pysaml2_project	pysaml2	*
debian	debian_linux	8.0
debian	debian_linux	9.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pysaml2_project:pysaml2:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "24F2FB4E-4F43-4B09-B01C-1B3FCB88AB2C",
              "versionEndIncluding": "4.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password."
    },
    {
      "lang": "es",
      "value": "pysaml2, en su versi\u00f3n 4.4.0 y anteriores, acepta cualquier contrase\u00f1a cuando se ejecuta con las optimizaciones de python habilitadas. Esto permite que atacantes inicien sesi\u00f3n como cualquier usuario sin conocer su contrase\u00f1a."
    }
  ],
  "id": "CVE-2017-1000433",
  "lastModified": "2026-06-17T00:59:10.227",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-01-02T23:29:00.337",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://github.com/rohe/pysaml2/issues/451"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/201801-11"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://github.com/rohe/pysaml2/issues/451"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/201801-11"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-924M-4PMX-C67H

Vulnerability from github – Published: 2018-07-13 16:01 – Updated: 2024-10-21 21:09

Summary

pysaml2 Improper Authentication vulnerability

Details

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pysaml2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-1000433"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:27:01Z",
    "nvd_published_at": "2018-01-02T23:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.",
  "id": "GHSA-924m-4pmx-c67h",
  "modified": "2024-10-21T21:09:04Z",
  "published": "2018-07-13T16:01:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000433"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rohe/pysaml2/issues/451"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IdentityPython/pysaml2/pull/454"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IdentityPython/pysaml2/commit/6312a41e037954850867f29d329e5007df1424a5"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-924m-4pmx-c67h"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pysaml2/PYSEC-2018-48.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rohe/pysaml2"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201801-11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "pysaml2 Improper Authentication vulnerability"
}

GSD-2017-1000433

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.

Aliases

CVE-2017-1000433

Aliases

CVE-2017-1000433

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2017-1000433",
    "description": "pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.",
    "id": "GSD-2017-1000433",
    "references": [
      "https://www.suse.com/security/cve/CVE-2017-1000433.html",
      "https://ubuntu.com/security/CVE-2017-1000433"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2017-1000433"
      ],
      "details": "pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.",
      "id": "GSD-2017-1000433",
      "modified": "2023-12-13T01:21:02.145891Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "DATE_ASSIGNED": "2017-12-29",
        "ID": "CVE-2017-1000433",
        "REQUESTER": "predrag.gruevski@gmail.com",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "[debian-lts-announce] 20180701 [SECURITY] [DLA 1410-1] python-pysaml2 security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html"
          },
          {
            "name": "https://github.com/rohe/pysaml2/issues/451",
            "refsource": "CONFIRM",
            "url": "https://github.com/rohe/pysaml2/issues/451"
          },
          {
            "name": "GLSA-201801-11",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/201801-11"
          },
          {
            "name": "[debian-lts-announce] 20210226 [SECURITY] [DLA 2577-1] python-pysaml2 security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c=4.4.0",
          "affected_versions": "All versions up to 4.4.0",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-287",
            "CWE-937"
          ],
          "date": "2019-10-03",
          "description": "pysaml2 accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.",
          "fixed_versions": [
            "4.5.0"
          ],
          "identifier": "CVE-2017-1000433",
          "identifiers": [
            "CVE-2017-1000433"
          ],
          "not_impacted": "All versions after 4.4.0",
          "package_slug": "pypi/pysaml2",
          "pubdate": "2018-01-02",
          "solution": "Upgrade to version 4.5.0 or above.",
          "title": "Improper Authentication",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2017-1000433",
            "https://github.com/rohe/pysaml2/issues/451",
            "https://security.gentoo.org/glsa/201801-11"
          ],
          "uuid": "f8d0fb5d-536c-4143-a443-882f6371e5ef"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:pysaml2_project:pysaml2:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.4.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-1000433"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-287"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/rohe/pysaml2/issues/451",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://github.com/rohe/pysaml2/issues/451"
            },
            {
              "name": "GLSA-201801-11",
              "refsource": "GENTOO",
              "tags": [
                "Issue Tracking",
                "Third Party Advisory"
              ],
              "url": "https://security.gentoo.org/glsa/201801-11"
            },
            {
              "name": "[debian-lts-announce] 20180701 [SECURITY] [DLA 1410-1] python-pysaml2 security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html"
            },
            {
              "name": "[debian-lts-announce] 20210226 [SECURITY] [DLA 2577-1] python-pysaml2 security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2021-03-04T21:16Z",
      "publishedDate": "2018-01-02T23:29Z"
    }
  }
}

PYSEC-2018-48

Vulnerability from pysec - Published: 2018-01-02 23:29 - Updated: 2021-07-05 00:01

Details

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.

Impacted products

Name	purl
pysaml2	pkg:pypi/pysaml2

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pysaml2",
        "purl": "pkg:pypi/pysaml2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.4.3",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.1.0",
        "2.0.0",
        "2.1.0",
        "2.2.0",
        "2.3.0",
        "2.4.0",
        "3.0.0",
        "3.0.2",
        "4.0.0",
        "4.0.1",
        "4.0.2",
        "4.0.3",
        "4.0.4",
        "4.0.5",
        "4.0.5rc1",
        "4.1.0",
        "4.2.0",
        "4.3.0",
        "4.4.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2017-1000433",
    "GHSA-924m-4pmx-c67h"
  ],
  "details": "pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.",
  "id": "PYSEC-2018-48",
  "modified": "2021-07-05T00:01:25.224283Z",
  "published": "2018-01-02T23:29:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://github.com/rohe/pysaml2/issues/451"
    },
    {
      "type": "ADVISORY",
      "url": "https://security.gentoo.org/glsa/201801-11"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-924m-4pmx-c67h"
    }
  ]
}

SUSE-SU-2018:1194-1

Vulnerability from csaf_suse - Published: 2018-05-09 14:19 - Updated: 2026-09-20 12:44

Summary

Security update for python-pysaml2

Severity

Low

Scope

1 vulnerability in this advisory, including CVE-2017-1000433.

CVE-2017-1000433

8.1 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Recommended: 1 product

Open the full advisory

SUSE-SU-2019:1450-1

Vulnerability from csaf_suse - Published: 2019-06-07 11:00 - Updated: 2019-06-07 11:00

Summary

Security update for Cloud7 packages

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2017-1000433.

CVE-2017-1000433

8.1 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Recommended: 34 products

Open the full advisory

UBUNTU-CVE-2017-1000433 (CVE-2017-1000433)

Vulnerability from osv_ubuntu – Published: 2018-01-02 00:00 – Updated: 2025-09-08 16:44 – Source website

Details

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.

Severity

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1 (High)


                    
                      CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2017-1000433	REPORT
	https://github.com/rohe/pysaml2/issues/451	REPORT
	https://ubuntu.com/security/notices/USN-3520-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-1000433	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "python-pysaml2",
            "binary_version": "3.0.0-3ubuntu1.16.04.3"
          },
          {
            "binary_name": "python3-pysaml2",
            "binary_version": "3.0.0-3ubuntu1.16.04.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "python-pysaml2",
        "purl": "pkg:deb/ubuntu/python-pysaml2@3.0.0-3ubuntu1.16.04.3?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.0-3ubuntu1.16.04.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.0-0ubuntu2",
        "3.0.0-3ubuntu1",
        "3.0.0-3ubuntu1.16.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": "pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.",
  "id": "UBUNTU-CVE-2017-1000433",
  "modified": "2025-09-08T16:44:37Z",
  "published": "2018-01-02T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-1000433"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rohe/pysaml2/issues/451"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3520-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-1000433"
    }
  ],
  "related": [
    "USN-3520-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-1000433"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2017-1000433 (GCVE-0-2017-1000433)

CNVD-2018-02432

FKIE_CVE-2017-1000433

GHSA-924M-4PMX-C67H

GSD-2017-1000433

PYSEC-2018-48

SUSE-SU-2018:1194-1

SUSE-SU-2019:1450-1

UBUNTU-CVE-2017-1000433 (CVE-2017-1000433)

Tags

Sightings

Nomenclature

Related by attack behaviour