CVE-2020-5390

NameCVE-2020-5390
DescriptionPySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertion that have been signed.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2119-1, DSA-4630-1
NVD severitymedium
Debian Bugs949322

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-pysaml2 (PTS)stretch (security), stretch3.0.0-5+deb9u1fixed
buster, buster (security)4.5.0-4+deb10u1fixed
bullseye, sid4.5.0-8fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-pysaml2sourcejessie2.0.0-1+deb8u3DLA-2119-1
python-pysaml2sourcestretch3.0.0-5+deb9u1DSA-4630-1
python-pysaml2sourcebuster4.5.0-4+deb10u1DSA-4630-1
python-pysaml2source(unstable)4.5.0-7949322

Notes

https://github.com/IdentityPython/pysaml2/commit/5e9d5acbcd8ae45c4e736ac521fd2df5b1c62e25 (v5.0.0)

Search for package or bug name: Reporting problems