CVE-2016-10127: XEE
It was found that python-pysaml2 is vulnerable to an XML external entity attack. python-pysaml2 does not sanitize SAML XML requests or responses.
References:
http://seclists.org/oss-sec/2017/q1/50 https://bugs.debian.org/850716
Upstream bug:
https://github.com/rohe/pysaml2/issues/366
Proposed patch (! actually fixes Bug 1415710):
https://github.com/rohe/pysaml2/pull/379
Other sources
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10127?
The severity of CVE-2016-10127 is considered high due to the potential for XML external entity attacks.
How do I fix CVE-2016-10127?
To fix CVE-2016-10127, update python-pysaml2 to a version later than 7.5.0 or 4.5.0 for the pip package.
What components are affected by CVE-2016-10127?
CVE-2016-10127 affects python-pysaml2 versions up to and including 7.5.0 and the pip package pysaml2 versions below 4.5.0.
What type of attack does CVE-2016-10127 facilitate?
CVE-2016-10127 facilitates XML external entity attacks due to insufficient sanitization of SAML XML requests or responses.
Is CVE-2016-10127 a concern for all users of python-pysaml2?
Yes, CVE-2016-10127 is a concern for all users of python-pysaml2, particularly those processing external XML data.