GitHub Advisoryadvisory · PyPI
GHSA-924m-4pmx-c67h pysaml2 Improper Authentication vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2017-1000433
- Ecosystem
- PyPI
- Packages
- pysaml2
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-287
- Reviewed
- 2020-06-16
Affected packages
• PyPI pysaml2: < 4.5.0 → fixed in 4.5.0
Description
pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.
Related
Alias · CVE (1)
- CVE-2017-1000433 pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000433 advisory
- https://github.com/rohe/pysaml2/issues/451 web
- https://github.com/IdentityPython/pysaml2/pull/454 web
- https://github.com/IdentityPython/pysaml2/commit/6312a41e037954850867f29d329e5007df1424a5 web
- https://github.com/advisories/GHSA-924m-4pmx-c67h advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/pysaml2/PYSEC-2018-48.yaml web
- https://github.com/rohe/pysaml2 package
- https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html web
- https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html web
- https://security.gentoo.org/glsa/201801-11 web