==========================================================================
Ubuntu Security Notice USN-3520-1
January 08, 2018

python-pysaml2 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 17.10
– Ubuntu 17.04
– Ubuntu 16.04 LTS

Summary:

PySAML2 could allow authentication without a password.

Software Description:
– python-pysaml2: Pure python implementation of SAML2

Details:

It was discovered that PySAML2 incorrectly accepted any password when
run with python optimizations enabled. An attacker could use this issue
to authenticate as any user without a valid password.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
  python-pysaml2                  3.0.0-3ubuntu2.2
  python3-pysaml2                 3.0.0-3ubuntu2.2

Ubuntu 17.04:
  python-pysaml2                  3.0.0-3ubuntu1.17.04.3
  python3-pysaml2                 3.0.0-3ubuntu1.17.04.3

Ubuntu 16.04 LTS:
  python-pysaml2                  3.0.0-3ubuntu1.16.04.3
  python3-pysaml2                 3.0.0-3ubuntu1.16.04.3

In general, a standard system update will make all the necessary
changes.

References:
  https://www.ubuntu.com/usn/usn-3520-1
  CVE-2017-1000433

Package Information:
  https://launchpad.net/ubuntu/+source/python-pysaml2/3.0.0-3ubuntu2.2
  https://launchpad.net/ubuntu/+source/python-pysaml2/3.0.0-3ubuntu1.17.04.3
  https://launchpad.net/ubuntu/+source/python-pysaml2/3.0.0-3ubuntu1.16.04.3
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2

iQIcBAABCAAGBQJaU6t+AAoJEEW851uECx9pUl4P+wYSFYclcr1by+HoaD+T6fkc
WfQMI1n5NqxxMNGVVMPt4tD7ZE9TLrUbu2gsaGmv+9+7o5RA4cskAOUFXsxAkvPB
B0tOVkNcoxanqeJdK+Ge25oNliwd2U2NCaWXdiiSFP9piDhdqBGW0kkwrJ0ZZ+tg
D6cA7dZ3BkBjTAmxYGzOmag4wXVUp8o+u3oalta8DS+UxF8DZavmqktrOpIjT38B
Mypx5Afv/pDcedUPKutmqwRMelH0za4iIy1p6ISkUW/IIKqmqIL/1g1u4/xzxrO9
ubi3o85yFcOLc/57XYjnhGT0fDNqGj05SbHQKqjxpnazcERar7yTPVPy42rM3DGW
F1cQX/R2eED5n/ea2wjcddpDQEIRfES2tj3omxVHQEXF1GB+jMZt6h2RFc5MHaUL
OXe/3LS9qMcq07xUw3R71FDHZZjFd5ttzRzsw4MTR6/uKzHoAAYGgZbXVYDkyy3e
Y8Zw6QjrNT29onritf5jrugs2lewJlUkpgsBuYBQD5n57M3sZXM3xSPWXHBgdbqV
uYCl+dAm9FpMVG8BucAvbeYO7zuMaoesJVeVVkm8ui+KpXnXuRZk5+gbFw3VSxPA
Y0ccA2H4LR9Z9oW9OIVCQq0d5r3SKTx3pYlFVKUjK1HV2SysdeRJr4meg9ryLryU
v1vRGnNM3pwhv6njIMVT
=ujco
—–END PGP SIGNATURE—–
—