CRITICAL9.8

PYSEC-2023-261

Quick fix

PYSEC-2023-261 — sap-xssec: upgrade to the fixed version with the command below.

pip install --upgrade 'sap-xssec>=4.1.0'

Details

SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/sap-xssec

Introduced in: 0Fixed in: 4.1.0

Fixpip install --upgrade 'sap-xssec>=4.1.0'

References

https://me.sap.com/notes/3411067[WEB]
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html[ADVISORY]
https://pypi.org/project/sap-xssec/[PACKAGE]
https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/[ADVISORY]
https://github.com/SAP/cloud-pysec/security/advisories/GHSA-6mjg-37cp-42x5[ADVISORY]
https://github.com/SAP/cloud-pysec/[WEB]