7.5

CVE-2016-10149

XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pysaml2 Project ≫ Pysaml2 Version <= 4.4.0
Debian ≫ Debian Linux Version8.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.86% 0.888
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

http://www.openwall.com/lists/oss-security/2017/01/19/5
Patch
Third Party Advisory
Mailing List
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716
Patch
Third Party Advisory
Issue Tracking
https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b
Patch
Third Party Advisory
Issue Tracking
https://github.com/rohe/pysaml2/issues/366
Patch
Third Party Advisory
Issue Tracking
https://github.com/rohe/pysaml2/pull/379
Patch
Third Party Advisory
Issue Tracking
http://www.debian.org/security/2017/dsa-3759
Third Party Advisory
http://www.securityfocus.com/bid/97692
https://access.redhat.com/errata/RHSA-2017:0936
https://access.redhat.com/errata/RHSA-2017:0937
https://access.redhat.com/errata/RHSA-2017:0938