CVE-2020-5390: High severity Pysaml2 Project Pysaml2 vulnerability
Last updated 25 August 2025
Other sources
PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertion that have been signed.
— Launchpad
PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertions that have been signed.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pysaml2to a version that resolves this vulnerability.Fixed in 5.0.0 - Upgrade
Upgrade
debian/python-pysaml2to a version that resolves this vulnerability.Fixed in 6.5.1-1Fixed in 7.0.1-2Fixed in 7.5.0-4Fixed in 7.5.4-2 - Upgrade
Upgrade
pysaml2to a version that resolves this vulnerability.Fixed in 5.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2020-5390?
CVE-2020-5390 has a high severity rating due to its potential to enable XML Signature Wrapping attacks.
How do I fix CVE-2020-5390?
To fix CVE-2020-5390, upgrade PySAML2 to version 5.0.0 or later.
Which versions of PySAML2 are affected by CVE-2020-5390?
CVE-2020-5390 affects all versions of PySAML2 prior to 5.0.0.
Is CVE-2020-5390 present in Debian or Ubuntu distributions?
Yes, CVE-2020-5390 is present in various Debian and Ubuntu distributions that utilize vulnerable versions of PySAML2.
What is the impact of exploiting CVE-2020-5390?
Exploiting CVE-2020-5390 could allow attackers to manipulate SAML signatures, potentially leading to unauthorized access.