https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 18:19:30 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-02841 bdu:2024-02841 https://cve.radiocsirt.org/vuln/bdu:2024-02841 https://cve.radiocsirt.org/vuln/euvd-2026-22097 EUVD-2026-22097 https://cve.radiocsirt.org/vuln/euvd-2026-22097 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21238 <p>PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.</p> <p>PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-21238 https://cve.radiocsirt.org/vuln/ghsa-f4g9-h89h-jgv9 <p><strong>Affected:</strong> PyPI: pysaml2</p> <p>### Impact</p> <p>All users of pysaml2 that use the default `CryptoBackendXmlSec1` backend and need to verify signed SAML documents are impacted. `pysaml2 &lt;= 6.4.1` does not validate the SAML document against an XML schema. This allows invalid XML documents to trick the verification process, by presenting elements with a valid signature inside elements whose content has been malformed. The verification is offloaded to `xmlsec1` and `xmlsec1` will not validate every signature in the given document, but only the first it finds in the given scope.</p> <p>### Patches</p> <p>Users should upgrade to pysaml2 `v6.5.0`.</p> <p>### Workarounds</p> <p>No workaround provided at this point.</p> <p>### References</p> <p>No references provided at this point.</p> <p>### Credits</p> <p>- Victor Schönfelder Garcia (isits AG International School of IT Security) - Juraj Somorovsky (Paderborn University) - Vladislav Mladenov (Ruhr University Bochum)</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory: * Open an issue in [pysaml2](https://github.com/IdentityPython/pysaml2) * Email us at [the incident-response address](mailto:incident-response@idpy.org)</p> <p><strong>Affected:</strong> PyPI: pysaml2</p> <p>### Impact</p> <p>All users of pysaml2 that use the default `CryptoBackendXmlSec1` backend and need to verify signed SAML documents are impacted. `pysaml2 &lt;= 6.4.1` does not validate the SAML document against an XML schema. This allows invalid XML documents to trick the verification process, by presenting elements with a valid signature inside elements whose content has been malformed. The verification is offloaded to `xmlsec1` and `xmlsec1` will not validate every signature in the given document, but only the first it finds in the given scope.</p> <p>### Patches</p> <p>Users should upgrade to pysaml2 `v6.5.0`.</p> <p>### Workarounds</p> <p>No workaround provided at this point.</p> <p>### References</p> <p>No references provided at this point.</p> <p>### Credits</p> <p>- Victor Schönfelder Garcia (isits AG International School of IT Security) - Juraj Somorovsky (Paderborn University) - Vladislav Mladenov (Ruhr University Bochum)</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory: * Open an issue in [pysaml2](https://github.com/IdentityPython/pysaml2) * Email us at [the incident-response address](mailto:incident-response@idpy.org)</p> https://cve.radiocsirt.org/vuln/ghsa-f4g9-h89h-jgv9 https://cve.radiocsirt.org/vuln/gsd-2021-21238 gsd-2021-21238 https://cve.radiocsirt.org/vuln/gsd-2021-21238 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11258-1 <p>python36-pysaml2-7.0.1-1.2 on GA media</p> <p>python36-pysaml2-7.0.1-1.2 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:11258-1 https://cve.radiocsirt.org/vuln/pysec-2021-48 <p><strong>Affected:</strong> PyPI: pysaml2</p> <p>PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.</p> <p><strong>Affected:</strong> PyPI: pysaml2</p> <p>PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.</p> https://cve.radiocsirt.org/vuln/pysec-2021-48 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-21238 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-pysaml2, Ubuntu:18.04:LTS: python-pysaml2, Ubuntu:20.04:LTS: python-pysaml2, Ubuntu:22.04:LTS: python-pysaml2</p> <p>PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-pysaml2, Ubuntu:18.04:LTS: python-pysaml2, Ubuntu:20.04:LTS: python-pysaml2, Ubuntu:22.04:LTS: python-pysaml2</p> <p>PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-21238