CVE-2017-1000433: PYSEC-2018-48 - pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user

CVE-2017-1000433 · Severity: low · CVSS 3.1 · Published 2018-01-02

Technologies: pysaml2 (PyPI). Vendors: PyPI.

Executive brief

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.

Affected products

PyPI pysaml2

Related threats

PYSEC-2021-49 - PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signa
PYSEC-2021-48 - PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signa
PYSEC-2020-94 - PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is
PYSEC-2017-26 - Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak en
PYSEC-2017-25 - XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML