Bug 50860 - python-pysaml2: Multiple issues (4.4)
python-pysaml2: Multiple issues (4.4)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.4
All Linux
: P3 normal (vote)
: UCS 4.4-3-errata
Assigned To: Quality Assurance
Philipp Hahn
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-02-27 15:27 CET by Quality Assurance
Modified: 2020-03-11 14:41 CET (History)
0 users

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2020-02-27 15:27:22 CET
New Debian python-pysaml2 3.0.0-5+deb9u1A~4.4.3.202002271527 fixes:
This update addresses the following issue:
* does not check that the signature in a SAML document is enveloped  (CVE-2020-5390)
Comment 1 Quality Assurance univentionstaff 2020-02-27 16:00:21 CET
--- mirror/ftp/4.2/unmaintained/4.2-0/source/python-pysaml2_3.0.0-5A~4.2.0.201702151906.dsc
+++ apt/ucs_4.4-0-errata4.4-3/source/python-pysaml2_3.0.0-5+deb9u1A~4.4.3.202002271527.dsc
@@ -1,9 +1,10 @@
-3.0.0-5A~4.2.0.201702151906 [Wed, 15 Feb 2017 19:06:22 +0100] Univention builddaemon <buildd@univention.de>:
+3.0.0-5+deb9u1A~4.4.3.202002271527 [Thu, 27 Feb 2020 15:27:41 +0100] Univention builddaemon <buildd@univention.de>:
 
-  * UCS auto build. The following patches have been applied to the original source package
-    002
-    003-remove-python3
-    debhelper
+  * UCS auto build. No patches were applied to the original source package
+
+3.0.0-5+deb9u1 [Wed, 19 Feb 2020 21:45:47 +0100] Moritz Mühlenhoff <jmm@debian.org>:
+
+  * CVE-2020-5390
 
 3.0.0-5 [Mon, 09 Jan 2017 16:28:55 +0100] Thomas Goirand <zigo@debian.org>:
 

<http://10.200.17.11/4.4-3/#6384251841503905756>
Comment 2 Philipp Hahn univentionstaff 2020-02-27 16:56:05 CET
REOPEN: Patches were not applied for the new import!
Comment 3 Philipp Hahn univentionstaff 2020-03-09 10:35:27 CET
Another case of Bug #49600 in Repo-NG

svn18790 Bug #50860: python-pysaml2 3.0.0-5+deb9u1
svn18791 Bug #50860: python-pysaml2 3.0.0-5+deb9u1

Package: python-pysaml2
Version: 3.0.0-5+deb9u1A~4.4.3.2020031032
Branch: ucs_4.4-0
Scope: errata4.4-3

[4.4-3] 6ae58f1711 Bug #50860: python-pysaml2 3.0.0-5+deb9u1A~4.4.3.2020031032
 doc/errata/staging/python-pysaml2.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
Comment 4 Quality Assurance univentionstaff 2020-03-09 10:41:33 CET
--- mirror/ftp/4.2/unmaintained/4.2-0/source/python-pysaml2_3.0.0-5A~4.2.0.201702151906.dsc
+++ apt/ucs_4.4-0-errata4.4-3/source/python-pysaml2_3.0.0-5+deb9u1A~4.4.3.2020031032.dsc
@@ -1,9 +1,13 @@
-3.0.0-5A~4.2.0.201702151906 [Wed, 15 Feb 2017 19:06:22 +0100] Univention builddaemon <buildd@univention.de>:
+3.0.0-5+deb9u1A~4.4.3.2020031032 [Mon, 09 Mar 2020 10:32:29 +0100] Univention builddaemon <buildd@univention.de>:
 
   * UCS auto build. The following patches have been applied to the original source package
     002
     003-remove-python3
     debhelper
+
+3.0.0-5+deb9u1 [Wed, 19 Feb 2020 21:45:47 +0100] Moritz Mühlenhoff <jmm@debian.org>:
+
+  * CVE-2020-5390
 
 3.0.0-5 [Mon, 09 Jan 2017 16:28:55 +0100] Thomas Goirand <zigo@debian.org>:
 

<http://10.200.17.11/4.4-3/#5984639022036714843>
Comment 5 Philipp Hahn univentionstaff 2020-03-09 13:49:39 CET
OK: yaml
OK: announce_errata
OK: patch
OK: piuparts

[4.4-3] 6ae58f1711 Bug #50860: python-pysaml2 3.0.0-5+deb9u1A~4.4.3.2020031032
 doc/errata/staging/python-pysaml2.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

[4.4-3] 1ee5a18abb Bug #50860: python-pysaml2 3.0.0-5+deb9u1A~4.4.3.202002271527
 doc/errata/staging/python-pysaml2.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
Comment 6 Erik Damrose univentionstaff 2020-03-11 14:41:51 CET
<http://errata.software-univention.de/ucs/4.4/471.html>