CVE-2021-21238

Katalog CVE

CVSS 6.5 · Medium EPSS 1,1%

Kerentanan Improper Verification of Cryptographic Signature pada pysaml2 project pysaml2. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.

Rincian

Terbit di NVD

21 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/IdentityPython/pysaml2/commit/1d8fd268f5bf887480a403a7a5ef8f048157cc14 patch · advisory pihak ketiga
• https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0 advisory pihak ketiga
• https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9 advisory pihak ketiga
• https://pypi.org/project/pysaml2 product · advisory pihak ketiga