Bug 1794740 (CVE-2020-5390)
Summary: | CVE-2020-5390 python-pysaml2: does not check that the signature in a SAML document is enveloped | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED WONTFIX | QA Contact: | |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | unspecified | CC: | apevec, apevec, jjoyce, jschluet, lhh, lpeer, mburns, nkinder, sclewis, slinaber |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | python-pysaml2 5.0.0 | Doc Type: | If docs needed, set a value |
Doc Text: |
A verification flaw was found in python-pysaml2, where it did not check that the signature in a SAML document was enveloped, which enabled XML signature wrapping (XSW) attacks. A remote attacker could exploit this flaw to convince SAML processing to verify the signature and accept malicious data. This issue specifically affects the verification of signed SAML assertions.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2021-10-28 01:55:35 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1794741, 1794742, 1795501, 1795502, 1795503 | ||
Bug Blocks: | 1794743 |
Description
Guilherme de Almeida Suckevicz
2020-01-24 14:06:03 UTC
Created python-pysaml2 tracking bugs for this issue: Affects: fedora-all [bug 1794741] Affects: openstack-rdo [bug 1794742] Statement: All versions of Red Hat OpenStack Platform ship but do not use the flawed check-signature functionality of python-pysaml2. The impact for these products is therefore rated as having a security impact of Low. Mitigation: There is no known mitigation for this issue, the flaw can only be resolved by applying updates. |