Pysaml2 improperly initializes encryption vector

보통 5.3CVE-2017-1000246 · GHSA-cq94-qf6q-mf2h · PYSEC-2017-26 · Published 17/11/2017 · updated 17/06/2026

요약

CVE-2017-1000246은(는) pysaml2, pysaml2 (pysaml2 project)에 영향을 주는 보통 (CVSS 5.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.89%, 전체 취약점의 59.4%보다 높음.
조치: 4.6.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
pysaml2 PyPI	`< 4.6.0`	`4.6.0`
pysaml2 pysaml2_project	`< 4.6.0`	`4.6.0`

Description

Python package pysaml2 version 4.5.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.

NVD description

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.

References

nvd.nist.gov/vuln/detail/CVE-2017-1000246 · ADVISORY
rohe/pysaml2 · WEB
IdentityPython/pysaml2#519 · WEB
pypa/advisory-database · WEB
rohe/pysaml2 · PACKAGE
GitHub Advisory GHSA-cq94-qf6q-mf2h · ADVISORY

pysaml2의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pysaml2

PyPI

< 4.6.0

4.6.0

pysaml2

pysaml2_project

< 4.6.0

4.6.0

Description

Python package pysaml2 version 4.5.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.

NVD description

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.

pysaml2의 다른 취약점

모두 보기 →