Login
Login-Name Passwort


 
Newsletter
Werbung

Sicherheit: XML External Entity-Verarbeitung in python-pysaml2
Aktuelle Meldungen Distributionen
Name: XML External Entity-Verarbeitung in python-pysaml2
ID: DSA-3759-1
Distribution: Debian
Plattformen: Debian jessie
Datum: Do, 12. Januar 2017, 09:29
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10127

Originalnachricht

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3759-1 security@debian.org
https://www.debian.org/security/ Sebastien Delafond
January 12, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : python-pysaml2
CVE ID : CVE-2016-10127
Debian Bug : 850716

Matias P. Brutti discovered that python-pysaml2, a Python
implementation of the Security Assertion Markup Language 2.0, did not
correctly sanitize the XML messages it handled. This allowed a remote
attacker to perform XML External Entity attacks, leading to a wide
range of exploits.

For the stable distribution (jessie), this problem has been fixed in
version 2.0.0-1+deb8u1.

For the testing (stretch) and unstable (sid) distributions, this
problem has been fixed in version 3.0.0-5.

We recommend that you upgrade your python-pysaml2 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlh3KEQACgkQEL6Jg/PV
nWTjMQf+MQjGv4HoEMj7xp6EpheezdV5mCyXbq2/0WZCvpct+rp0I2mgXCMhHYCr
kRQNtRY8TIbV+lpbB9mKtNueGVvjWBqt17o6OFHUXacbW+VoMwwsRO9tHJfJY3b2
dCYcKfAj1o4/Zka/DhQFfNcjAzWvaCaOjMfqpPRl40guzJ/0C5UM5TnPuy1amKBZ
qurwjmeiG54B5dsm4k5NmKToCCT55Lexx6C9snkcvfPv+rrLPeBfQSYCwD7Qj+ZQ
kK04sY7TOBDKQjtI+mwz/jIzMepYb++89cDVoIvyWqmJ/l2Qbe3alF2B5kZY12uG
BAER3whGyVWTwXjIm6fxWkb8fQfVzw==
=FGtk
-----END PGP SIGNATURE-----
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung