PyPI/python-saml CVE-2017-11427: high 7.7, EPSS 4.37%

Python-saml allows manipulation of SAML data without invalidation of cryptographic signature

Action: Upgrade python-saml to 2.4.0 or later.

pip install python-saml==2.4.0

Affected

Fixed versions

Sources

• osv: GHSA-j8j8-348v-wfm3
• https://nvd.nist.gov/vuln/detail/CVE-2017-11427
• https://github.com/SAML-Toolkits/python-saml/commit/fad881b4432febea69d70691dfed51c93f0de10f
• https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
• https://github.com/SAML-Toolkits/python-saml
• https://github.com/advisories/GHSA-j8j8-348v-wfm3
• https://github.com/pypa/advisory-database/tree/main/vulns/python-saml/PYSEC-2019-198.yaml
• https://www.kb.cert.org/vuls/id/475445

CVE-2017-11427 · published 2019-07-05T21:11:26Z · modified 2024-10-25T21:25:35.106871Z · JSON