What is GHSA-m269-wj6g-c459?

GHSA-m269-wj6g-c459 is a security advisory published by GitHub Security Advisories with Critical severity. PySAML2 XML external entity attack

Which CVE IDs does GHSA-m269-wj6g-c459 cover?

GHSA-m269-wj6g-c459 covers the following CVE IDs: CVE-2016-10127. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m269-wj6g-c459?

GHSA-m269-wj6g-c459 has a CVSS v3 base score of 9.0, published by GitHub Security Advisories.

Which products are affected by GHSA-m269-wj6g-c459?

GHSA-m269-wj6g-c459 affects 1 product, including: pip/pysaml2:\u003c 4.5.0.

GHSA-m269-wj6g-c459CriticalCVSS 9.0

PySAML2 XML external entity attack

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

October 24, 2024

🔗 CVE IDs covered (1)

CVE-2016-10127 →

📋 Description

PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.

🎯 Affected products1

pip/pysaml2:< 4.5.0

🔗 References (9)

https://nvd.nist.gov/vuln/detail/CVE-2016-10127
https://github.com/rohe/pysaml2/issues/366
https://github.com/rohe/pysaml2/pull/379
https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716
http://www.openwall.com/lists/oss-security/2017/01/19/5
https://github.com/advisories/GHSA-m269-wj6g-c459
https://github.com/pypa/advisory-database/tree/main/vulns/pysaml2/PYSEC-2017-67.yaml
https://web.archive.org/web/20200227195127/http://www.securityfocus.com/bid/95376