Python-saml allows manipulation of SAML data without invalidation of cryptographic signature
High severity
GitHub Reviewed
Published
Jul 5, 2019
to the GitHub Advisory Database
•
Updated Sep 1, 2023
Description
Published to the GitHub Advisory Database
Jul 5, 2019
Reviewed
Jun 16, 2020
Last updated
Sep 1, 2023
OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
References