CVE-2016-10149
Pysaml2 does not sanitize XML responses
CVE-2016-10149 is a high vulnerability (CVSS 7.5) in Pysaml2 Project Pysaml2, published January 12, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.02%, the 92nd percentile. Fixed in pysaml2 4.5.0.
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
- Record
CVE-2016-10149- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
- Record
CVE-2016-10149- Updated
- 2026-11-02
EUVDEUVD-2017-0104 No score
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
- Record
EUVD-2017-0104- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c2vx-49jm-h3f6
Pysaml2 does not sanitize XML responses
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
- Record
GHSA-c2vx-49jm-h3f6- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
- Record
CVE-2016-10149- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-10149
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
- Record
DEBIAN-CVE-2016-10149- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-c2vx-49jm-h3f6
Pysaml2 does not sanitize XML responses
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
- Record
GHSA-c2vx-49jm-h3f6- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVRHSA-2017:0936
Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update
- Record
RHSA-2017:0936- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVRHSA-2017:0937
Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update
- Record
RHSA-2017:0937- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVRHSA-2017:0938
Red Hat Security Advisory: python-defusedxml and python-pysaml2 security update
- Record
RHSA-2017:0938- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10149
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
- Record
UBUNTU-CVE-2016-10149- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVPYSEC-2017-25 No score
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
- Record
PYSEC-2017-25- Updated
- 2026-11-02
OSVSUSE-SU-2017:0569-1 No score
Security update for python-pysaml2
This update for python-pysaml2 fixes the following issues:
-
CVE-2016-10127 and CVE-2016-10149: XXE (XML external entity) issues were fixed in python-pysaml2, where external requests to other XML content could be made by parsing XML files using this SAML2 library. (bsc#1019074)
To fix this bug, the new dependency python-defusedxml was added and is used for sanitizing XML content.
- Record
SUSE-SU-2017:0569-1- Updated
- 2026-11-02
OSVUSN-3402-1 No score
python-pysaml2 vulnerability
It was discovered that PySAML2 incorrectly handled certain SAML XML requests and responses. A remote attacker could use this issue to read arbitrary files.
- Record
USN-3402-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pysaml2PyPI |
through 4.4.0 | 4.5.0 |
python-pysaml2Debian:12 |
before 3.0.0-5 | 3.0.0-5 |
python-pysaml2Debian:13 |
before 3.0.0-5 | 3.0.0-5 |
python-pysaml2Debian:14 |
before 3.0.0-5 | 3.0.0-5 |
python-pysaml2Debian:8 |
before 2.0.0-1+deb8u1, plus listed versions 2.0.0-1 |
2.0.0-1+deb8u1 |
pysaml2PyPI |
before 4.5.0, plus listed versions 0.4.31.0.11.0.21.0.31.1.0 Show 18 moreShow less2.0.02.1.02.2.02.3.02.4.03.0.03.0.24.0.04.0.14.0.24.0.34.0.44.0.54.0.5rc14.1.04.2.04.3.04.4.0 |
4.5.0 |
python-defusedxmlRed Hat:openstack:8::el7 |
before 0:0.5.0-1.el7ost | 0:0.5.0-1.el7ost |
python-pysaml2Red Hat:openstack:8::el7 |
before 0:3.0.2-3.el7ost | 0:3.0.2-3.el7ost |
python-defusedxmlRed Hat:openstack:9::el7 |
before 0:0.5.0-1.el7ost | 0:0.5.0-1.el7ost |
python-pysaml2Red Hat:openstack:9::el7 |
before 0:3.0.2-3.el7ost | 0:3.0.2-3.el7ost |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-defusedxmlRed Hat:openstack:10::el7 |
before 0:0.5.0-1.el7ost | 0:0.5.0-1.el7ost |
python-pysaml2Red Hat:openstack:10::el7 |
before 0:3.0.2-3.el7ost | 0:3.0.2-3.el7ost |
python-defusedxmlSUSE:OpenStack Cloud 6 |
before 0.4.1-2.1 | 0.4.1-2.1 |
python-pysaml2SUSE:OpenStack Cloud 6 |
before 2.4.0-3.1 | 2.4.0-3.1 |
python-pysaml2Ubuntu:16.04:LTS |
before 3.0.0-3ubuntu1.16.04.1, plus listed versions 2.4.0-0ubuntu23.0.0-3ubuntu1 |
3.0.0-3ubuntu1.16.04.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/rohe/pysaml2/issues/366
access.redhat.com/errata/RHSA-2017:0936
openwall.com/lists/oss-security/2017/01/19/5
securityfocus.com/bid/97692
debian.org/security/2017/dsa-3759
Show 22 moreShow less
bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716
nvd.nist.gov/vuln/detail/CVE-2016-10149
security-tracker.debian.org/tracker/CVE-2016-10149
bugzilla.redhat.com/show_bug.cgi?id=1415710
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0936.json
cve.org/CVERecord?id=CVE-2016-10149
suse.com/support/update/announcement/2017/suse-su-20170569-1
bugzilla.suse.com/1019074
ubuntu.com/security/CVE-2016-10149