SB2021012302 - Improper Verification of Cryptographic Signature in py3-saml2 (Alpine package)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021012302

SB2021012302 - Improper Verification of Cryptographic Signature in py3-saml2 (Alpine package)

Published: January 23, 2021

Security Bulletin ID SB2021012302
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2021-21238)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.


Remediation

Install update from vendor's website.

References