github - ghsa-f4g9-h89h-jgv9

ghsa-f4g9-h89h-jgv9

Vulnerability from github

Published

2021-01-21 14:12

Modified

2024-10-14 15:50

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Summary

SAML XML Signature wrapping in PySAML2

Details

Impact

All users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. pysaml2 <= 6.4.1 does not validate the SAML document against an XML schema. This allows invalid XML documents to trick the verification process, by presenting elements with a valid signature inside elements whose content has been malformed. The verification is offloaded to xmlsec1 and xmlsec1 will not validate every signature in the given document, but only the first it finds in the given scope.

Patches

Users should upgrade to pysaml2 v6.5.0.

Workarounds

No workaround provided at this point.

References

No references provided at this point.

Credits

Victor Schönfelder Garcia (isits AG International School of IT Security)
Juraj Somorovsky (Paderborn University)
Vladislav Mladenov (Ruhr University Bochum)

For more information

If you have any questions or comments about this advisory: * Open an issue in pysaml2 * Email us at the incident-response address

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pysaml2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21238"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-01-21T14:11:38Z",
    "nvd_published_at": "2021-01-21T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nAll users of pysaml2 that use the default `CryptoBackendXmlSec1` backend and need to verify signed SAML documents are impacted. `pysaml2 \u003c= 6.4.1` does not validate the SAML document against an XML schema. This allows invalid XML documents to trick the verification process, by presenting elements with a valid signature inside elements whose content has been malformed. The verification is offloaded to `xmlsec1` and `xmlsec1` will not validate every signature in the given document, but only the first it finds in the given scope.\n\n### Patches\n\nUsers should upgrade to pysaml2 `v6.5.0`.\n\n### Workarounds\n\nNo workaround provided at this point.\n\n### References\n\nNo references provided at this point.\n\n### Credits\n\n- Victor Scho\u0308nfelder Garcia (isits AG International School of IT Security)\n- Juraj Somorovsky (Paderborn University)\n- Vladislav Mladenov (Ruhr University Bochum)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [pysaml2](https://github.com/IdentityPython/pysaml2)\n* Email us at [the incident-response address](mailto:incident-response@idpy.org)",
  "id": "GHSA-f4g9-h89h-jgv9",
  "modified": "2024-10-14T15:50:30Z",
  "published": "2021-01-21T14:12:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21238"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IdentityPython/pysaml2/commit/1d8fd268f5bf887480a403a7a5ef8f048157cc14"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/IdentityPython/pysaml2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pysaml2/PYSEC-2021-48.yaml"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/pysaml2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SAML XML Signature wrapping in PySAML2"
}

pysec-2021-48

Vulnerability from pysec

Published

2021-01-21 15:15

Modified

2021-01-29 17:58

Details

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pysaml2",
        "purl": "pkg:pypi/pysaml2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1d8fd268f5bf887480a403a7a5ef8f048157cc14"
            }
          ],
          "repo": "https://github.com/IdentityPython/pysaml2",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.4.3",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.1.0",
        "2.0.0",
        "2.1.0",
        "2.2.0",
        "2.3.0",
        "2.4.0",
        "3.0.0",
        "3.0.2",
        "4.0.0",
        "4.0.1",
        "4.0.2",
        "4.0.3",
        "4.0.4",
        "4.0.5rc1",
        "4.0.5",
        "4.1.0",
        "4.2.0",
        "4.3.0",
        "4.4.0",
        "4.5.0",
        "4.6.0",
        "4.6.1",
        "4.6.2",
        "4.6.3",
        "4.6.4",
        "4.6.5",
        "4.7.0",
        "4.8.0",
        "4.9.0",
        "5.0.0",
        "5.1.0",
        "5.2.0",
        "5.3.0",
        "5.4.0",
        "6.0.0",
        "6.1.0",
        "6.2.0",
        "6.3.0",
        "6.3.1",
        "6.4.0",
        "6.4.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21238",
    "GHSA-f4g9-h89h-jgv9"
  ],
  "details": "PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.",
  "id": "PYSEC-2021-48",
  "modified": "2021-01-29T17:58:00Z",
  "published": "2021-01-21T15:15:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/pysaml2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0"
    },
    {
      "type": "FIX",
      "url": "https://github.com/IdentityPython/pysaml2/commit/1d8fd268f5bf887480a403a7a5ef8f048157cc14"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9"
    }
  ]
}

cve-2021-21238

Vulnerability from cvelistv5

Published

2021-01-21 14:15

Modified

2024-08-03 18:09

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Summary

References

▼	URL	Tags
	https://pypi.org/project/pysaml2	x_refsource_MISC
	https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0	x_refsource_MISC
	https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9	x_refsource_CONFIRM
	https://github.com/IdentityPython/pysaml2/commit/1d8fd268f5bf887480a403a7a5ef8f048157cc14	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

IdentityPython

pysaml2

Version: < 6.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:09:15.156Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://pypi.org/project/pysaml2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/IdentityPython/pysaml2/commit/1d8fd268f5bf887480a403a7a5ef8f048157cc14"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pysaml2",
          "vendor": "IdentityPython",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-21T14:15:27",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pypi.org/project/pysaml2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IdentityPython/pysaml2/commit/1d8fd268f5bf887480a403a7a5ef8f048157cc14"
        }
      ],
      "source": {
        "advisory": "GHSA-f4g9-h89h-jgv9",
        "discovery": "UNKNOWN"
      },
      "title": "SAML XML Signature wrapping",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-21238",
          "STATE": "PUBLIC",
          "TITLE": "SAML XML Signature wrapping"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "pysaml2",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 6.5.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IdentityPython"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-347 Improper Verification of Cryptographic Signature"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://pypi.org/project/pysaml2",
              "refsource": "MISC",
              "url": "https://pypi.org/project/pysaml2"
            },
            {
              "name": "https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0",
              "refsource": "MISC",
              "url": "https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0"
            },
            {
              "name": "https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9",
              "refsource": "CONFIRM",
              "url": "https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9"
            },
            {
              "name": "https://github.com/IdentityPython/pysaml2/commit/1d8fd268f5bf887480a403a7a5ef8f048157cc14",
              "refsource": "MISC",
              "url": "https://github.com/IdentityPython/pysaml2/commit/1d8fd268f5bf887480a403a7a5ef8f048157cc14"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-f4g9-h89h-jgv9",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-21238",
    "datePublished": "2021-01-21T14:15:27",
    "dateReserved": "2020-12-22T00:00:00",
    "dateUpdated": "2024-08-03T18:09:15.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-f4g9-h89h-jgv9

Vulnerability from github

Impact

Patches

Workarounds

References

Credits

For more information

pysec-2021-48

Vulnerability from pysec

cve-2021-21238

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature