Bug 2007587 (CVE-2021-21239) - CVE-2021-21239 python-pysaml2: An improper verification of cryptographic signature
Summary: CVE-2021-21239 python-pysaml2: An improper verification of cryptographic sign...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2021-21239
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2007589 2007588 2007590 2009613 2009614
Blocks: 2007596
TreeView+ depends on / blocked
 
Reported: 2021-09-24 10:45 UTC by Marian Rehak
Modified: 2021-11-22 00:23 UTC (History)
13 users (show)

Fixed In Version: python-pysaml2 6.5.0
Doc Type: If docs needed, set a value
Doc Text:
A verification flaw was found in python-pysaml2, where it did not ensure that a signed SAML document was correctly signed. The default CryptoBackendXmlSec1 backend uses the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 must be configured explicitly to only use only x509 certificates for the verification process of the SAML document signature.
Clone Of:
Environment:
Last Closed: 2021-11-22 00:19:22 UTC
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2021-09-24 10:45:26 UTC 
An improper verification of cryptographic signature. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature.

Upstream Advisory:

https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-5p3x-r448-pc62
Comment 1 Marian Rehak 2021-09-24 10:45:49 UTC 
Created python-pysaml2 tracking bugs for this issue:

Affects: epel-8 [bug 2007589]
Affects: fedora-all [bug 2007588]
Affects: openstack-rdo [bug 2007590]
Comment 2 Summer Long 2021-10-01 03:19:00 UTC 
Upstream fix: https://github.com/IdentityPython/pysaml2/commit/751dbf50a51131b13d55989395f9b115045f9737
Comment 5 Product Security DevOps Team 2021-11-22 00:19:19 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-21239
Note You need to log in before you can comment on or make changes to this bug.