—

PYSEC-2017-26

Quick fix

PYSEC-2017-26 — pysaml2: upgrade to the fixed version with the command below.

pip install --upgrade 'pysaml2>=4.6.0'

Details

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/pysaml2

Introduced in: 0Fixed in: 4.6.0

Fixpip install --upgrade 'pysaml2>=4.6.0'

References

https://github.com/rohe/pysaml2/issues/417[REPORT]
https://github.com/advisories/GHSA-cq94-qf6q-mf2h[ADVISORY]