Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2021-21239

Improper Verification of Cryptographic Signature

Published: Jan 21, 2021 | Modified: Nov 21, 2024
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
6.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2021-21239
CWEhttps://cwe.mitre.org/data/definitions/347.html

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only x509 certificates for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0.

Weakness

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected Software

NameVendorStart VersionEnd Version
Pysaml2Pysaml2_project*6.5.0 (excluding)
Python-pysaml2Ubuntubionic*
Python-pysaml2Ubuntudevel*
Python-pysaml2Ubuntuesm-infra/bionic*
Python-pysaml2Ubuntuesm-infra/focal*
Python-pysaml2Ubuntuesm-infra/xenial*
Python-pysaml2Ubuntufocal*
Python-pysaml2Ubuntugroovy*
Python-pysaml2Ubuntuhirsute*
Python-pysaml2Ubuntuimpish*
Python-pysaml2Ubuntujammy*
Python-pysaml2Ubuntutrusty*
Python-pysaml2Ubuntuupstream*
Python-pysaml2Ubuntuxenial*

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use