==========================================================================
Ubuntu Security Notice USN-3520-1
January 08, 2018
python-pysaml2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 17.10
– Ubuntu 17.04
– Ubuntu 16.04 LTS
Summary:
PySAML2 could allow authentication without a password.
Software Description:
– python-pysaml2: Pure python implementation of SAML2
Details:
It was discovered that PySAML2 incorrectly accepted any password when
run with python optimizations enabled. An attacker could use this issue
to authenticate as any user without a valid password.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
python-pysaml2 3.0.0-3ubuntu2.2
python3-pysaml2 3.0.0-3ubuntu2.2
Ubuntu 17.04:
python-pysaml2 3.0.0-3ubuntu1.17.04.3
python3-pysaml2 3.0.0-3ubuntu1.17.04.3
Ubuntu 16.04 LTS:
python-pysaml2 3.0.0-3ubuntu1.16.04.3
python3-pysaml2 3.0.0-3ubuntu1.16.04.3
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3520-1
CVE-2017-1000433
Package Information:
https://launchpad.net/ubuntu/+source/python-pysaml2/3.0.0-3ubuntu2.2
https://launchpad.net/ubuntu/+source/python-pysaml2/3.0.0-3ubuntu1.17.04.3
https://launchpad.net/ubuntu/+source/python-pysaml2/3.0.0-3ubuntu1.16.04.3
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2
iQIcBAABCAAGBQJaU6t+AAoJEEW851uECx9pUl4P+wYSFYclcr1by+HoaD+T6fkc
WfQMI1n5NqxxMNGVVMPt4tD7ZE9TLrUbu2gsaGmv+9+7o5RA4cskAOUFXsxAkvPB
B0tOVkNcoxanqeJdK+Ge25oNliwd2U2NCaWXdiiSFP9piDhdqBGW0kkwrJ0ZZ+tg
D6cA7dZ3BkBjTAmxYGzOmag4wXVUp8o+u3oalta8DS+UxF8DZavmqktrOpIjT38B
Mypx5Afv/pDcedUPKutmqwRMelH0za4iIy1p6ISkUW/IIKqmqIL/1g1u4/xzxrO9
ubi3o85yFcOLc/57XYjnhGT0fDNqGj05SbHQKqjxpnazcERar7yTPVPy42rM3DGW
F1cQX/R2eED5n/ea2wjcddpDQEIRfES2tj3omxVHQEXF1GB+jMZt6h2RFc5MHaUL
OXe/3LS9qMcq07xUw3R71FDHZZjFd5ttzRzsw4MTR6/uKzHoAAYGgZbXVYDkyy3e
Y8Zw6QjrNT29onritf5jrugs2lewJlUkpgsBuYBQD5n57M3sZXM3xSPWXHBgdbqV
uYCl+dAm9FpMVG8BucAvbeYO7zuMaoesJVeVVkm8ui+KpXnXuRZk5+gbFw3VSxPA
Y0ccA2H4LR9Z9oW9OIVCQq0d5r3SKTx3pYlFVKUjK1HV2SysdeRJr4meg9ryLryU
v1vRGnNM3pwhv6njIMVT
=ujco
—–END PGP SIGNATURE—–
—
