{"id":"CVE-2017-11427","aliases":["EUVD-2019-0118","GHSA-j8j8-348v-wfm3","PYSEC-2019-198","SUSE-SU-2021:0048-1","openSUSE-SU-2024:11262-1","openSUSE-SU-2024:14159-1","openSUSE-SU-2026:12034-1"],"status":"published","title":"Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal","description":"OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.","severity":{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.04368,"percentile":0.91332,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-287"],"published":"2019-04-17T13:59:19Z","modified":"2026-10-24T10:30:19Z","exploits":[{"source":"pocgithub","id":"CHYbeta/CVE-2017-11427-DEMO","title":"CHYbeta/CVE-2017-11427-DEMO","date":"2018-03-03","url":"https://github.com/CHYbeta/CVE-2017-11427-DEMO"}],"fixes":[{"ecosystem":"PyPI","package":"python-saml","fixed_in":["2.4.0"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"python-defusedxml","fixed_in":["0.6.0-1.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"python-freezegun","fixed_in":["0.3.12-1.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"python-isodate","fixed_in":["0.6.0-1.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"python-pkgconfig","fixed_in":["1.5.1-1.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"python-python3-saml","fixed_in":["1.9.0-1.5.2"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"python-xmlsec","fixed_in":["1.3.6-1.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-python3-saml","fixed_in":["1.15.0-2.3","1.16.0-2.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"python-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"python-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0"]},{"source":"osv","ecosystem":"PyPI","package":"python-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0"]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"python-defusedxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-1.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"python-freezegun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.12-1.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"python-isodate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-1.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"python-pkgconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-1.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"python-python3-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1.5.2"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"python-xmlsec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-python3-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-2.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-python3-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-2.4"}]}]}],"products":[{"vendor":"onelogin","product":"pythonsaml"}],"references":[{"url":"https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence","web","article"]},{"url":"https://www.kb.cert.org/vuls/id/475445","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11427","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j8j8-348v-wfm3","tags":["advisory"]},{"url":"https://github.com/SAML-Toolkits/python-saml/commit/fad881b4432febea69d70691dfed51c93f0de10f","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/python-saml/PYSEC-2019-198.yaml","tags":["web"]},{"url":"https://github.com/SAML-Toolkits/python-saml","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210048-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1019074","tags":["report"]},{"url":"https://bugzilla.suse.com/1041090","tags":["report"]},{"url":"https://bugzilla.suse.com/1177200","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11427","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-11427","title":"Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal","description":"OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.","status":"published","published":"2019-04-17T13:59:19Z","modified":"2024-08-05T18:12:39.492Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:33:19.848632Z"}],"euvd":[{"id":"EUVD-2019-0118","description":"OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.","status":"published","published":"2019-04-17T13:59:19Z","modified":"2024-08-05T18:12:39Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T02:23:23.645757Z"}],"ghsa":[{"id":"GHSA-j8j8-348v-wfm3","title":"Python-saml allows manipulation of SAML data without invalidation of cryptographic signature","description":"OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.","status":"published","published":"2019-07-05T21:11:26Z","modified":"2024-10-25T21:17:28Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"high"},{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:38:13.09489Z"}],"nvd":[{"id":"CVE-2017-11427","description":"OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.","status":"published","published":"2019-04-17T14:29:00.247Z","modified":"2026-06-17T01:01:47.823Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:04:19.545286Z"}],"osv":[{"id":"CVE-2017-11427","description":"OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.","status":"published","published":"2019-04-17T14:29:00.247Z","modified":"2026-10-24T10:30:19.247394342Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"GHSA-j8j8-348v-wfm3","title":"Python-saml allows manipulation of SAML data without invalidation of cryptographic signature","description":"OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.","status":"published","published":"2019-07-05T21:11:26Z","modified":"2024-10-25T21:25:35.106871Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"openSUSE-SU-2024:11262-1","title":"python36-python3-saml-1.11.0-1.2 on GA media","description":"These are all security issues fixed in the python36-python3-saml-1.11.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:39:05.776323Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14159-1","title":"python310-python3-saml-1.15.0-2.3 on GA media","description":"These are all security issues fixed in the python310-python3-saml-1.15.0-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T03:20:48.472123Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:12034-1","title":"python313-python3-saml-1.16.0-2.4 on GA media","description":"These are all security issues fixed in the python313-python3-saml-1.16.0-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:30.644252601Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"PYSEC-2019-198","description":"OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.","status":"published","published":"2019-04-17T14:29:00Z","modified":"2023-11-08T03:58:49.295677Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"SUSE-SU-2021:0048-1","title":"Security update for python-defusedxml, python-freezegun, python-pkgconfig, python-python3-saml, python-xmlsec","description":"This update for python-defusedxml, python-freezegun, python-pkgconfig, python-python3-saml, python-xmlsec fixes the following issues:\n\n\n- Update to 0.6.0\n  - Increase test coverage.\n  - Add badges to README.\n  - Test on Python 3.7 stable and 3.8-dev\n  - Drop support for Python 3.4\n  - No longer pass *html* argument to XMLParse. It has been deprecated and\n    ignored for a long time. The DefusedXMLParser still takes a html argument.\n    A deprecation warning is issued when the argument is False and a TypeError\n    when it's True.\n  - defusedxml now fails early when pyexpat stdlib module is not available or\n    broken.\n  - defusedxml.ElementTree.__all__ now lists ParseError as public attribute.\n  - The defusedxml.ElementTree and defusedxml.cElementTree modules had a typo\n    and used XMLParse instead of XMLParser as an alias for DefusedXMLParser.\n    Both the old and fixed name are now available.\n\n- Remove superfluous devel dependency for noarch package\n\n- Update to 5.0\n  * Add compatibility with Python 3.6\n  * Drop support for Python 2.6, 3.1, 3.2, 3.3\n  * Fix lxml tests (XMLSyntaxError: Detected an entity reference loop)\n- Implement single-spec version.\n\n- Dummy changelog for bsc#1019074, FATE#322329\n\n- Add dependency on the full python (which is not pulled by\n  setuptools anymore). Use %{pythons} macro now. (bsc#1177200)\n\n- Upgrade to 0.3.12:\n  * Refactor classes to functions\n  * Ignore Selenium\n  * Move to pytest\n  * Conditionally patch time.clock (removed in 3.8)\n  * Patch time.time_ns added in Python 3.7\n\n- Do not require python2 module for building python3 module\n\n- Update to 0.3.11:\n    * Performance improvements\n    * Fix nesting time.time\n    * Add nanosecond property\n\n- Remove superfluous devel dependency for noarch package\n\n- Add remove_dependency_on_mock.patch which removes dependency on\n  python-mock for Python 3, where it is not required.\n\n- update to 0.3.10 \n * Performance improvements\n * Coroutine support\n\n- update to version 0.3.9\n  * If no time to be frozen, use current time\n  * Fix uuid1 issues\n  * Add support for python 3.6\n\nupdate to version 0.3.8\n  * Improved unpatching when importing modules after freeze_time start()\n  * Add manual increment via tick method\n  * Fix bug with time.localtime not being reset. Closes #112.\n  * Fix test to work when current timezone is GMT-14 or GMT+14.\n  * Fixed #162 - allow decorating old-style classes.\n  * Add support to PyMySQL\n  * Assume the default time to freeze is 'now'.\n  * Register fake types in PyMySQL conversions\n  * Ignore threading and Queue modules. Closes #129.\n  * Lock down coverage version since new coverage doesnt support py3.2\n  * Fix or py3 astimezone and not passing tz. Closes #138.\n  * Add note about deafult arguments. Closes #140.\n  * Add license info. Closes #120.\n\n- Update to 0.3.5\n  * No upstream changelog\n- Remove unneeded freeze_hideDeps.patch\n\n- Use download Url as source\n- Use tarball provided by pypi\n\n- update to 1.5.1\n  * Use poetry instead of setuptools directly\n  * Fix #42: raise exception if package is missing\n  * Fix version parsing for openssl-like version numbers, fixes #32\n  * Add boolean static keyword to output private libraries as well\n  * Raise original OSError as well\n\n- Add missing test dependency pkgconfig\n\n","status":"published","published":"2021-01-08T12:37:58Z","modified":"2026-02-04T02:21:19.493367Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}