VDB
DEBIAN-CVE-2017-1000433
DEBIAN-CVE-2017-1000433
PUBLISHED
CVSS 8.100000381469727 HIGH
Record from OSV · Published January 2, 2018
pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| python-pysaml2 | Debian:13 | 4.5.0-2 |
| python-pysaml2 | Debian:14 | 4.5.0-2 |
| python-pysaml2 | Debian:12 | 4.5.0-2 |
Risk scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | python-pysaml2 | 0 |
| Debian:14 | python-pysaml2 | 0 |
| Debian:12 | python-pysaml2 | 0 |
Timeline
- Jan 2, 2018 CVE Published
- Sep 1, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2017-1000433
vulnetix vdb fixes DEBIAN-CVE-2017-1000433Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2017-1000433/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart