PYSEC-2019-198

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/python-saml/PYSEC-2019-198.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2019-198

Aliases

Published

2019-04-17T14:29:00Z

Modified

2023-11-08T03:58:49Z

Summary

[none]

Details

OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

References

Affected packages

PyPI / python-saml

Package

Name: python-saml; View open source insights on deps.dev
Purl: pkg:pypi/python-saml

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.0

Affected versions

2.*

2.0.0

2.0.1

2.0.2

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.2.0

2.2.1

2.2.2

2.2.3

2.3.0

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/python-saml/PYSEC-2019-198.yaml"