9

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pysaml2 Project ≫ Pysaml2 Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.13% 0.796
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9 2.3 6
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

http://www.openwall.com/lists/oss-security/2017/01/19/5
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/95376
VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716
Third Party Advisory
Mailing List
https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b
Patch
https://github.com/rohe/pysaml2/issues/366
Patch
Issue Tracking
https://github.com/rohe/pysaml2/pull/379
Patch
Issue Tracking