CVE-2016-10127 PySAML2 XML external entity attack
CriticalCVSS 9.0
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pysaml2(PyPI) | < 4.5.0 | 4.5.0 |
| pypi pysaml2(PyPI) | = 0.4.3 | No fix listed |
| pypi pysaml2(PyPI) | = 1.0.1 | No fix listed |
| pypi pysaml2(PyPI) | = 1.0.2 | No fix listed |
| pypi pysaml2(PyPI) | = 1.0.3 | No fix listed |
| pypi pysaml2(PyPI) | = 1.1.0 | No fix listed |
| pypi pysaml2(PyPI) | = 2.0.0 | No fix listed |
| pypi pysaml2(PyPI) | = 2.1.0 | No fix listed |
| pypi pysaml2(PyPI) | = 2.2.0 | No fix listed |
| pypi pysaml2(PyPI) | = 2.3.0 | No fix listed |
| pypi pysaml2(PyPI) | = 2.4.0 | No fix listed |
| pypi pysaml2(PyPI) | = 3.0.0 | No fix listed |
| pypi pysaml2(PyPI) | = 3.0.2 | No fix listed |
| pypi pysaml2(PyPI) | = 4.0.0 | No fix listed |
| pypi pysaml2(PyPI) | = 4.0.1 | No fix listed |
| pypi pysaml2(PyPI) | = 4.0.2 | No fix listed |
| pypi pysaml2(PyPI) | = 4.0.3 | No fix listed |
| pypi pysaml2(PyPI) | = 4.0.4 | No fix listed |
| pypi pysaml2(PyPI) | = 4.0.5 | No fix listed |
| pypi pysaml2(PyPI) | = 4.0.5rc1 | No fix listed |
| pypi pysaml2(PyPI) | = 4.1.0 | No fix listed |
| pypi pysaml2(PyPI) | = 4.2.0 | No fix listed |
| pypi pysaml2(PyPI) | = 4.3.0 | No fix listed |
| pypi pysaml2(PyPI) | = 4.4.0 | No fix listed |
| debian/python-pysaml2(Debian:12) | All versions | No fix listed |
Show 36 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/python-pysaml2(Debian:12) | = 7.0.1-2 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.2.1-1 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.2.1-2 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.2.1-3 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.4.2-1 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.4.2-2 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.4.2-3 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.4.2-4 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.4.2-5 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.5.0-1 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.5.0-2 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.5.0-3 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.5.0-4 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.5.0-5 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.5.0-6 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.5.0-7 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.5.4-1 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.5.4-2 | No fix listed |
| debian/python-pysaml2(Debian:12) | = 7.5.4-3 | No fix listed |
| debian/python-pysaml2(Debian:13) | All versions | No fix listed |
| debian/python-pysaml2(Debian:13) | = 7.5.0-4 | No fix listed |
| debian/python-pysaml2(Debian:13) | = 7.5.0-5 | No fix listed |
| debian/python-pysaml2(Debian:13) | = 7.5.0-6 | No fix listed |
| debian/python-pysaml2(Debian:13) | = 7.5.0-7 | No fix listed |
| debian/python-pysaml2(Debian:13) | = 7.5.4-1 | No fix listed |
| debian/python-pysaml2(Debian:13) | = 7.5.4-2 | No fix listed |
| debian/python-pysaml2(Debian:13) | = 7.5.4-3 | No fix listed |
| debian/python-pysaml2(Debian:14) | All versions | No fix listed |
| debian/python-pysaml2(Debian:14) | = 7.5.0-4 | No fix listed |
| debian/python-pysaml2(Debian:14) | = 7.5.0-5 | No fix listed |
| debian/python-pysaml2(Debian:14) | = 7.5.0-6 | No fix listed |
| debian/python-pysaml2(Debian:14) | = 7.5.0-7 | No fix listed |
| debian/python-pysaml2(Debian:14) | = 7.5.4-1 | No fix listed |
| debian/python-pysaml2(Debian:14) | = 7.5.4-2 | No fix listed |
| debian/python-pysaml2(Debian:14) | = 7.5.4-3 | No fix listed |
| pysaml2 project pysaml2 | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch
- github.com issue-tracking patch
- github.com patch
- bugs.debian.org mailing-list third-party-advisory
- github.com vendor-advisory
- github.com
- github.com product
- web.archive.org
- [oss-security] 20170119 Re: CVE request: python-pysaml2 XML external entity attack mailing-list third-party-advisory
- 95376 vdb-entry
- Debian Security Tracker CVE-2016-10127 vendor-advisory
- bugs.debian.org issue-tracking