Bug 2007587 (CVE-2021-21239)

Summary:	CVE-2021-21239 python-pysaml2: An improper verification of cryptographic signature
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apevec, apevec, dbecker, jjoyce, jschluet, lhh, lpeer, mburns, nkinder, openstack-sig, rhos-maint, sclewis, slinaber
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	python-pysaml2 6.5.0	Doc Type:	If docs needed, set a value
Doc Text:	A verification flaw was found in python-pysaml2, where it did not ensure that a signed SAML document was correctly signed. The default CryptoBackendXmlSec1 backend uses the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 must be configured explicitly to only use only x509 certificates for the verification process of the SAML document signature.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-22 00:19:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2007589, 2007588, 2007590, 2009613, 2009614
Bug Blocks:	2007596

Description Marian Rehak 2021-09-24 10:45:26 UTC

An improper verification of cryptographic signature. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature.

Upstream Advisory:

https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-5p3x-r448-pc62

Comment 1 Marian Rehak 2021-09-24 10:45:49 UTC

Created python-pysaml2 tracking bugs for this issue:

Affects: epel-8 [bug 2007589]
Affects: fedora-all [bug 2007588]
Affects: openstack-rdo [bug 2007590]

Comment 2 Summer Long 2021-10-01 03:19:00 UTC

Upstream fix: https://github.com/IdentityPython/pysaml2/commit/751dbf50a51131b13d55989395f9b115045f9737

Comment 5 Product Security DevOps Team 2021-11-22 00:19:19 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-21239