CVE-2021-21239: Open default xmlsec1 key-type preference
Vulnerability summary
CVE-2021-21239 is a medium (CVSS 6.5) vulnerability in debian debian_linux. EPSS estimates a 1.29% chance of exploitation in the next 30 days, higher than 70.2% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 4Timeline
- 21-01-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0.
CVSS metrics
8 scores · 6 sources · 3 versions- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS trend
Probability
1.29%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
Increase +0.02 pp
From 1.27% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (aleksey.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- python-pysaml2< 6.5.1-1
- debian_linuxEOL9.0
Alpine1 product
- py3-saml2< 6.4.1-r1 | < 6.5.0-r0
Identitypython1 product
- pysaml2< 6.5.0
PyPI1 product
- pysaml2< 46578df0695269a16f1c94171f1429873f90ed99 | < 6.5.0
Pysaml2_project1 product
- pysaml2< 6.5.0
Ubuntu1 product
- python-pysaml2< 6.1.0-0ubuntu2 | < 4.0.2-0ubuntu3.2 | < 4.9.0-0ubuntu3.1 | < 3.0.0-3ubuntu1.16.04.4+esm1
6 vendors · 7 products
References
15 links- github.com/IdentityPython/pysaml2/security/advisories/GHSA-5p3x-r448-pc62X Refsource CONFIRMWEBAdvisoryREPORTThird Party Advisory
- www.aleksey.com/pipermail/xmlsec/2013/009717.htmlX Refsource MISCWEBREPORTExploitMailing ListThird Party Advisory
- github.com/IdentityPython/pysaml2/commit/46578df0695269a16f1c94171f1429873f90ed99X Refsource MISCWEBFIXPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2021/02/msg00038.htmlMailing ListX Refsource MLISTWEBThird Party Advisory