GHSA-924m-4pmx-c67h

Suggest an improvement
Source
https://github.com/advisories/GHSA-924m-4pmx-c67h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-924m-4pmx-c67h/GHSA-924m-4pmx-c67h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-924m-4pmx-c67h
Aliases
Published
2018-07-13T16:01:17Z
Modified
2024-10-21T21:25:30.520963Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
pysaml2 Improper Authentication vulnerability
Details

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.

Database specific
{
    "nvd_published_at": "2018-01-02T23:29:00Z",
    "cwe_ids": [
        "CWE-287"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:27:01Z"
}
References

Affected packages

PyPI / pysaml2

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.5.0

Affected versions

0.*

0.4.3

1.*

1.0.1
1.0.2
1.0.3
1.1.0

2.*

2.0.0
2.1.0
2.2.0
2.3.0
2.4.0

3.*

3.0.0
3.0.2

4.*

4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5rc1
4.0.5
4.1.0
4.2.0
4.3.0
4.4.0