CVE-2016-10149

Published: Mar 24, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.

Affected (2)

Products: Pysaml2 Project: Pysaml2 · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pysaml2 Project Pysaml2	Up to 4.4.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (20)

http://www.debian.org/security/2017/dsa-3759

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2017/01/19/5

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/97692

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2017:0936

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2017:0937

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2017:0938

Source: cve@mitre.org

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/rohe/pysaml2/issues/366

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/rohe/pysaml2/pull/379

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

http://www.debian.org/security/2017/dsa-3759