delta/python-packages/pysaml2.git/tests/xmlsec1-keydata/signed-assertion-random-embedded-cert.xml, branch master github.com: rohe/pysaml2.git Fix CVE-2021-21239 - Restrict the key data that xmlsec1 accepts to only x509 certs 2021-01-18T07:35:44+00:00 Ivan Kanakarakis ivan.kanak@gmail.com 2021-01-04T20:52:07+00:00 751dbf50a51131b13d55989395f9b115045f9737 All users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. pysaml2 <= 6.4.1 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default, xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only x509 certificates for the verification process of the SAML document signature. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com> 
All users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to
verify signed SAML documents are impacted. pysaml2 <= 6.4.1 does not ensure that a
signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is
using the xmlsec1 binary to verify the signature of signed SAML documents, but by
default, xmlsec1 accepts any type of key found within the given document. xmlsec1 needs
to be configured explicitly to only use only x509 certificates for the verification
process of the SAML document signature.

Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>