VYPR
← All advisories
Moderate severityNVD Advisory· Published Jan 21, 2021· Updated Aug 3, 2024

SAML XML Signature wrapping

CVE-2021-21238

Description

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pysaml2PyPI
< 6.5.06.5.0

Affected products

157

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.