CVE-2017-1000246: Weak Encryption
Published Nov 17, 2017
·Updated
Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
Other sources
Python package pysaml2 version 4.5.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
Affected Software
2 affected componentsFixes available
pip/pysaml2<4.6.0
4.6.0
Pysaml2 Project Pysaml2<4.6.0
Remediation
Patch Available
Event History
Nov 17, 2017
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Data Sourced
via NVD·04:29 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jul 16, 2018
Advisory Published
04:50 PM
Frequently Asked Questions
1
What is the severity of CVE-2017-1000246?
CVE-2017-1000246 has a medium severity rating due to its weak encryption resulting from the reuse of initialization vectors.
2
How do I fix CVE-2017-1000246?
To fix CVE-2017-1000246, upgrade the pysaml2 package to version 4.6.0 or later.
3
Which versions of pysaml2 are affected by CVE-2017-1000246?
CVE-2017-1000246 affects pysaml2 versions 4.4.0 and earlier.
4
What type of vulnerability is CVE-2017-1000246?
CVE-2017-1000246 is a cryptographic vulnerability caused by reusing initialization vectors.
5
Is CVE-2017-1000246 specific to certain environments?
CVE-2017-1000246 specifically affects the IDP server using the pysaml2 package.