VDB
PYSEC-2018-48
PYSEC-2018-48
PUBLISHED
Record from OSV · Published January 2, 2018
pysaml2 is fixed in 4.5.0 (PyPI)
pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| pysaml2 | PyPI | 4.5.0 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | pysaml2 | 4.0.0, 0, 0.4.3 |
Timeline
- Jan 2, 2018 CVE Published
- Nov 8, 2023 CVE Updated
- May 1, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln PYSEC-2018-48
vulnetix vdb fixes PYSEC-2018-48Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/PYSEC-2018-48/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/advisories/GHSA-924m-4pmx-c67h advisory
- https://security.gentoo.org/glsa/201801-11 advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00000.html advisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html advisory
- https://github.com/rohe/pysaml2/issues/451 report