CVE-2016-10149

Publicada em 24 mar 2017 · Atualizada em 06 ago 2024

Seguir esta CVE + Monitorar python-pysaml2 + Monitorar pysaml2

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 5.0%

XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.

Produtos afetados

n/a · n/a

Referências

https://access.redhat.com/errata/RHSA-2017:0936 https://access.redhat.com/errata/RHSA-2017:0937 https://access.redhat.com/errata/RHSA-2017:0938 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716 https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b https://github.com/rohe/pysaml2/issues/366 https://github.com/rohe/pysaml2/pull/379 http://www.debian.org/security/2017/dsa-3759 http://www.openwall.com/lists/oss-security/2017/01/19/5 http://www.securityfocus.com/bid/97692