GHSA-924m-4pmx-c67h

pysaml2 Improper Authentication vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2017-1000433

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pysaml2	< 4.5.0	4.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-1000433 advisory
https://github.com/rohe/pysaml2/issues/451 web
https://github.com/IdentityPython/pysaml2/pull/454 web
https://github.com/IdentityPython/pysaml2/commit/6312a41e037954850867f29d329e5007df1424a5 web
https://github.com/advisories/GHSA-924m-4pmx-c67h advisory
https://github.com/pypa/advisory-database/tree/main/vulns/pysaml2/PYSEC-2018-48.yaml web
https://github.com/rohe/pysaml2 package
https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html web
https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html web
https://security.gentoo.org/glsa/201801-11 web