CVE-2017-11427

These are all security issues fixed in the python36-python3-saml-1.11.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-python3-saml-1.15.0-2.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-python3-saml-1.16.0-2.4 package on the GA media of openSUSE Tumbleweed.

OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

This update for python-defusedxml, python-freezegun, python-pkgconfig, python-python3-saml, python-xmlsec fixes the following issues:

• Update to 0.6.0

  • Increase test coverage.
  • Add badges to README.
  • Test on Python 3.7 stable and 3.8-dev
  • Drop support for Python 3.4
  • No longer pass html argument to XMLParse. It has been deprecated and ignored for a long time. The DefusedXMLParser still takes a html argument. A deprecation warning is issued when the argument is False and a TypeError when it's True.
  • defusedxml now fails early when pyexpat stdlib module is not available or broken.
  • defusedxml.ElementTree.all now lists ParseError as public attribute.
  • The defusedxml.ElementTree and defusedxml.cElementTree modules had a typo and used XMLParse instead of XMLParser as an alias for DefusedXMLParser. Both the old and fixed name are now available.

• Remove superfluous devel dependency for noarch package

• Update to 5.0

  • Add compatibility with Python 3.6
  • Drop support for Python 2.6, 3.1, 3.2, 3.3
  • Fix lxml tests (XMLSyntaxError: Detected an entity reference loop)

• Implement single-spec version.

• Dummy changelog for bsc#1019074, FATE#322329

• Add dependency on the full python (which is not pulled by setuptools anymore). Use %{pythons} macro now. (bsc#1177200)

• Upgrade to 0.3.12:

  • Refactor classes to functions
  • Ignore Selenium
  • Move to pytest
  • Conditionally patch time.clock (removed in 3.8)
  • Patch time.time_ns added in Python 3.7

• Do not require python2 module for building python3 module

• Update to 0.3.11:

  • Performance improvements
  • Fix nesting time.time
  • Add nanosecond property

• Remove superfluous devel dependency for noarch package

• Add remove_dependency_on_mock.patch which removes dependency on python-mock for Python 3, where it is not required.

• update to 0.3.10

• Performance improvements
• Coroutine support

• update to version 0.3.9
  • If no time to be frozen, use current time
  • Fix uuid1 issues
  • Add support for python 3.6

update to version 0.3.8

• Improved unpatching when importing modules after freeze_time start()
• Add manual increment via tick method
• Fix bug with time.localtime not being reset. Closes #112.
• Fix test to work when current timezone is GMT-14 or GMT+14.
• Fixed #162 - allow decorating old-style classes.
• Add support to PyMySQL
• Assume the default time to freeze is 'now'.
• Register fake types in PyMySQL conversions
• Ignore threading and Queue modules. Closes #129.
• Lock down coverage version since new coverage doesnt support py3.2
• Fix or py3 astimezone and not passing tz. Closes #138.
• Add note about deafult arguments. Closes #140.
• Add license info. Closes #120.

• Update to 0.3.5

  • No upstream changelog

• Remove unneeded freeze_hideDeps.patch

• Use download Url as source

• Use tarball provided by pypi

• update to 1.5.1

  • Use poetry instead of setuptools directly
  • Fix #42: raise exception if package is missing
  • Fix version parsing for openssl-like version numbers, fixes #32
  • Add boolean static keyword to output private libraries as well
  • Raise original OSError as well

• Add missing test dependency pkgconfig