Description
OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OneLogin | PythonSAML | unspecified – < 2.3.0 | 2.3.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 6 | python-defusedxml | 0.6.0-1.5.1 | SUSE-SU-2021:0048-1 |
| SUSE Enterprise Storage 6 | python-freezegun | 0.3.12-1.5.1 | SUSE-SU-2021:0048-1 |
| SUSE Enterprise Storage 6 | python-isodate | 0.6.0-1.3.2 | SUSE-SU-2021:0048-1 |
| SUSE Enterprise Storage 6 | python-pkgconfig | 1.5.1-1.5.1 | SUSE-SU-2021:0048-1 |
| SUSE Enterprise Storage 6 | python-python3-saml | 1.9.0-1.5.2 | SUSE-SU-2021:0048-1 |
| SUSE Enterprise Storage 6 | python-xmlsec | 1.3.6-1.5.1 | SUSE-SU-2021:0048-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-python3-saml | 1.15.0-2.3 | openSUSE-SU-2026:12034-1, openSUSE-SU-2024:14159-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
CHYbeta/CVE-2017-11427-DEMO ★ 12 · Mar 3, 2018
The Demo for CVE-2017-11427
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | python-saml | < 2.4.0 | 2.4.0 | GHSA-j8j8-348v-wfm3 |
Advisories 3
- openSUSE-SU-2026:12034-1 python313-python3-saml-1.16.0-2.4 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026
- openSUSE-SU-2024:14159-1 python310-python3-saml-1.15.0-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0048-1 Security update for python-defusedxml, python-freezegun, python-pkgconfig, python-python3-saml, python-xmlsec SUSE / openSUSE Security Updates · Feb 4, 2026