CVE Vulnerabilities

CVE-2021-21239

Improper Verification of Cryptographic Signature

Published: Jan 21, 2021 | Modified: Mar 10, 2021
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
6.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Ubuntu
MEDIUM

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only x509 certificates for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0.

Weakness

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected Software

Name Vendor Start Version End Version
Pysaml2 Pysaml2_project * 6.5.0 (excluding)
Python-pysaml2 Ubuntu bionic *
Python-pysaml2 Ubuntu devel *
Python-pysaml2 Ubuntu esm-infra/xenial *
Python-pysaml2 Ubuntu focal *
Python-pysaml2 Ubuntu groovy *
Python-pysaml2 Ubuntu hirsute *
Python-pysaml2 Ubuntu impish *
Python-pysaml2 Ubuntu jammy *
Python-pysaml2 Ubuntu trusty *
Python-pysaml2 Ubuntu upstream *
Python-pysaml2 Ubuntu xenial *

References