CVE-2020-5390

Katalog CVE

CVSS 7.5 · High EPSS 1,2%

Kerentanan Improper Verification of Cryptographic Signature pada pysaml2 project pysaml2, canonical ubuntu linux +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertion that have been signed.

Rincian

Terbit di NVD

13 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/IdentityPython/pysaml2/commit/5e9d5acbcd8ae45c4e736ac521fd2df5b1c62e25 patch · advisory pihak ketiga
• https://github.com/IdentityPython/pysaml2/commit/f27c7e7a7010f83380566a219fd6a290a00f2b6e patch · advisory pihak ketiga
• https://github.com/IdentityPython/pysaml2/releases release notes · advisory pihak ketiga
• https://github.com/IdentityPython/pysaml2/releases/tag/v5.0.0 release notes · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/02/msg00025.html mailing list · advisory pihak ketiga
• https://pypi.org/project/pysaml2/5.0.0/ product · advisory pihak ketiga
• https://usn.ubuntu.com/4245-1/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4630 advisory pihak ketiga