PyPI/python-saml CVE-2017-11427: unknown, EPSS 4.37%
OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without
Action: Upgrade python-saml to 2.4.0 or later.
pip install python-saml==2.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.4.0 | - |
Fixed versions
| 2.4.0 |
Sources
- osv: PYSEC-2019-198
- https://www.kb.cert.org/vuls/id/475445
- https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
- https://github.com/advisories/GHSA-j8j8-348v-wfm3
CVE-2017-11427 · published · modified · JSON