PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML     request or response. (CVE-2016-10127)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML
    request or response. (CVE-2016-10127)

Matias P. Brutti discovered that python-pysaml2, a Python implementation of the Security Assertion Markup Language 2.0, did not correctly sanitize the XML messages it handled. This allowed a remote attacker to perform XML External Entity attacks, leading to a wide range of exploits.

ID	Name	Product	Family	Severity
254069	Linux Distros Unpatched Vulnerability : CVE-2016-10127	Nessus	Misc.	critical
416645	SCA: security update for pysaml2 (GHSA-m269-wj6g-c459)	Tenable Cloud Security	SCA Checks	critical
416645	SCA: security update for pysaml2 (GHSA-m269-wj6g-c459)	Tenable Self-Hosted Container Security	SCA Checks	critical
96461	Debian DSA-3759-1 : python-pysaml2 - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-10127

critical

Tenable Plugins

critical

critical

critical

critical