RHSA-2017:0936: Moderate: python-defusedxml and python-pysaml2 security update
The defusedxml package contains several Python-only updates for security vulnerabilities in Python's XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues.PySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment.Security Fix(es): An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149)
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2017:0936?
The severity of RHSA-2017:0936 is classified as moderate.
How do I fix RHSA-2017:0936?
To fix RHSA-2017:0936, upgrade python-defusedxml to version 0.5.0-1.el7 or python-pysaml2 to version 3.0.2-3.el7.
What vulnerabilities does RHSA-2017:0936 address?
RHSA-2017:0936 addresses security vulnerabilities related to entity-expansion and DTD-retrieval issues in Python's XML libraries.
Which packages are affected by RHSA-2017:0936?
The affected packages in RHSA-2017:0936 include python-defusedxml and python-pysaml2.
Is the defusedxml package required for using PySAML2?
While the defusedxml package is not strictly required for PySAML2, it provides additional security against XML-related vulnerabilities.