CVE-2017-1000246
Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
02 / AFFECTED SOFTWARE
Affected packages
16 explicit affected versions
24 explicit affected versions
24 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
Python package pysaml2 version 4.5.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
05 / REFERENCES
Further evidence
- https://github.com/rohe/pysaml2/issues/417
- https://github.com/IdentityPython/pysaml2/pull/519/commits/7323f5c20efb59424d853c822e7a26d1aa3e84aa
- https://github.com/pypa/advisory-database/tree/main/vulns/pysaml2/PYSEC-2017-26.yaml
- https://github.com/rohe/pysaml2
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000246
- https://github.com/advisories/GHSA-cq94-qf6q-mf2h