GHSA-cq94-qf6q-mf2h

Pysaml2 improperly initializes encryption vector

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-1000246

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pysaml2	< 4.6.0	4.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

Python package pysaml2 version 4.5.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-1000246 advisory
https://github.com/rohe/pysaml2/issues/417 web
https://github.com/IdentityPython/pysaml2/pull/519/commits/7323f5c20efb59424d853c822e7a26d1aa3e84aa web
https://github.com/pypa/advisory-database/tree/main/vulns/pysaml2/PYSEC-2017-26.yaml web
https://github.com/rohe/pysaml2 package