Ubuntu Security Notice 3520-1 - It was discovered that PySAML2 incorrectly accepted any password when run with python optimizations enabled. An attacker could use this issue to authenticate as any user without a valid password.
6b101a157eaeef1fdcfeb5bd0ff7001066eb250d1d82741a1f8ed99760478903
==========================================================================
Ubuntu Security Notice USN-3520-1
January 08, 2018
python-pysaml2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
Summary:
PySAML2 could allow authentication without a password.
Software Description:
- python-pysaml2: Pure python implementation of SAML2
Details:
It was discovered that PySAML2 incorrectly accepted any password when
run with python optimizations enabled. An attacker could use this issue
to authenticate as any user without a valid password.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
python-pysaml2 3.0.0-3ubuntu2.2
python3-pysaml2 3.0.0-3ubuntu2.2
Ubuntu 17.04:
python-pysaml2 3.0.0-3ubuntu1.17.04.3
python3-pysaml2 3.0.0-3ubuntu1.17.04.3
Ubuntu 16.04 LTS:
python-pysaml2 3.0.0-3ubuntu1.16.04.3
python3-pysaml2 3.0.0-3ubuntu1.16.04.3
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3520-1
CVE-2017-1000433
Package Information:
https://launchpad.net/ubuntu/+source/python-pysaml2/3.0.0-3ubuntu2.2
https://launchpad.net/ubuntu/+source/python-pysaml2/3.0.0-3ubuntu1.17.04.3
https://launchpad.net/ubuntu/+source/python-pysaml2/3.0.0-3ubuntu1.16.04.3