CVE-2021-21238 log
| Source |
|
| Severity | High |
| Remote | No |
| Type | Signature forgery |
| Description | PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0. |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-1487 | python-pysaml2 | 6.4.1-1 | 6.5.1-1 | Critical | Fixed |