CVE-2016-1000252

Advisory

Python-saml 2.2.0 includes several fixes to prevent Signature Wrapping attacks.
https://github.com/onelogin/python-saml/commit/aeb25be9aff1313ec87c2f9b19687fb76088813f

Affected package

Affected versions

Fixed versions

Vulnerability changelog

* Prevent signature wrapping attack!!
* [111](https://github.com/onelogin/python-saml/pull/111) Add support for nested `NameID` children inside `AttributeValue`s
* ALOWED Misspell
* Improve how we obtain the settings path.
* Update docs adding reference to test depencence installation
* Fix Organization element on SP metadata.
* [100](https://github.com/onelogin/python-saml/pull/100) Support Responses that don't have AttributeStatements.

Resources

• https://pypi.org/project/python-saml
• https://pyup.io/changelogs/python-saml/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000252