CVE-2017-1000433: High severity pysaml2 vulnerability
Published Jan 2, 2018
·Updated
pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.
Affected Software
4 affected componentsFixes available
pip/pysaml2<4.5.0
4.5.0
Pysaml2 Project Pysaml2<=4.4.0
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Remediation
Patch Available
Event History
Jan 2, 2018
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Jul 13, 2018
Advisory Published
via GitHub·04:01 PM
Frequently Asked Questions
1
What is the severity of CVE-2017-1000433?
CVE-2017-1000433 has a high severity rating due to its potential for unauthorized access.
2
How do I fix CVE-2017-1000433?
To fix CVE-2017-1000433, upgrade pysaml2 to version 4.5.0 or later.
3
Which versions of pysaml2 are affected by CVE-2017-1000433?
Versions of pysaml2 up to and including 4.4.0 are affected by CVE-2017-1000433.
4
What platforms are impacted by CVE-2017-1000433?
CVE-2017-1000433 affects pysaml2 installations on Debian GNU/Linux versions 8.0 and 9.0.
5
Can CVE-2017-1000433 be exploited remotely?
Yes, CVE-2017-1000433 can be exploited remotely, allowing attackers to log in as any user without their password.