Skip to content
OpenAdvisories
High USN-4245-1 1 CVE

python-pysaml2 vulnerability

Published Jan 21, 2020 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PySAML2 incorrectly handled certain SAML files.
An attacker could possibly use this issue to bypass signature verification
with arbitrary data.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS python-pysaml2 3.0.0-3ubuntu1.16.04.4
Ubuntu · 18.04 LTS 18.04:LTS python-pysaml2 4.0.2-0ubuntu3.1

Vulnerabilities 1

  • High 7.5
    CVE-2020-5390

    Improper Verification of Cryptographic Signature in PySAML2

    PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in diffe…

    pysaml2 python-pysaml2 python-pysaml2 Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2020-5390