CVE-2017-1000433
Published: 2 January 2018
pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
python-pysaml2 Launchpad, Ubuntu, Debian |
artful |
Released
(3.0.0-3ubuntu2.2)
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(3.0.0-3ubuntu1.16.04.3)
|
|
| zesty |
Released
(3.0.0-3ubuntu1.17.04.3)
|
|
|
Patches: upstream: https://github.com/rohe/pysaml2/commit/efe27e2f40bf1c35d847f935ba74b4b86aa90fb5 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.1 |
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |