Skip to content
OpenAdvisories
High DLA-2577-1 2 CVEs

python-pysaml2 - security update

Published Feb 26, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 python-pysaml2 3.0.0-5+deb9u2

Vulnerabilities 2

  • High 8.1
    CVE-2017-1000433

    pysaml2 Improper Authentication vulnerability

    pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.

    pysaml2 python-pysaml2 python-pysaml2 Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2021-21239 Public exploit

    Open default xmlsec1 key-type preference

    PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML d…

    IdentityPython pysaml2 python-pysaml2 pysaml2 Debian Ubuntu Alpine PyPI