USN-3402-1 — python-pysaml2 vulnerability

Summary

It was discovered that PySAML2 incorrectly handled certain
SAML XML requests and responses. A remote attacker could use
this issue to read arbitrary files.

Fixed packages 1

Release	Package	Fixed in
Ubuntu · 16.04 LTS 16.04:LTS	python-pysaml2	3.0.0-3ubuntu1.16.04.1

Vulnerabilities 1

High 7.5

CVE-2016-10149

Pysaml2 does not sanitize XML responses

XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.

pysaml2 python-pysaml2 python-pysaml2 Debian Ubuntu PyPI

Mar 24, 2017

References

report
https://ubuntu.com/security/CVE-2016-10149

python-pysaml2 vulnerability

Summary

Fixed packages 1

Vulnerabilities 1

Pysaml2 does not sanitize XML responses

References