CVE-2017-11427 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2017-11427 Interim 1 26 2025-10-05T02:16:06Z current 2021-05-30T13:58:57Z 2025-10-05T02:16:06Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2017-11427 OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2021-January/008165.html E-Mail link for SUSE-SU-2021:0048-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Enterprise Storage 6 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 openSUSE Tumbleweed python-python3-saml python3-defusedxml-0.6.0-1.5.1 python3-freezegun-0.3.12-1.5.1 python3-isodate-0.6.0-1.3.2 python3-pkgconfig-1.5.1-1.5.1 python3-python3-saml python3-python3-saml-1.7.0-1.45 python3-python3-saml-1.7.0-150400.12.69 python3-python3-saml-1.7.0-150400.8.4 python3-python3-saml-1.9.0-1.5.2 python3-xmlsec-1.3.6-1.5.1 python310-python3-saml-1.15.0-2.3 python311-python3-saml-1.15.0-2.3 python312-python3-saml-1.15.0-2.3 python36-python3-saml-1.11.0-1.2 python38-python3-saml-1.11.0-1.2 python39-python3-saml-1.11.0-1.2 python3-defusedxml-0.6.0-1.5.1 as a component of SUSE Enterprise Storage 6 python3-freezegun-0.3.12-1.5.1 as a component of SUSE Enterprise Storage 6 python3-isodate-0.6.0-1.3.2 as a component of SUSE Enterprise Storage 6 python3-pkgconfig-1.5.1-1.5.1 as a component of SUSE Enterprise Storage 6 python3-python3-saml-1.9.0-1.5.2 as a component of SUSE Enterprise Storage 6 python3-xmlsec-1.3.6-1.5.1 as a component of SUSE Enterprise Storage 6 python3-python3-saml-1.7.0-1.45 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 python3-python3-saml-1.7.0-1.45 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python3-python3-saml-1.7.0-150400.8.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 python3-python3-saml-1.7.0-150400.8.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 python3-python3-saml-1.7.0-150400.12.69 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 python3-python3-saml-1.7.0-150400.12.69 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 python310-python3-saml-1.15.0-2.3 as a component of openSUSE Tumbleweed python311-python3-saml-1.15.0-2.3 as a component of openSUSE Tumbleweed python312-python3-saml-1.15.0-2.3 as a component of openSUSE Tumbleweed python36-python3-saml-1.11.0-1.2 as a component of openSUSE Tumbleweed python38-python3-saml-1.11.0-1.2 as a component of openSUSE Tumbleweed python39-python3-saml-1.11.0-1.2 as a component of openSUSE Tumbleweed python3-python3-saml as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 python-python3-saml as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers. CVE-2017-11427 SUSE Enterprise Storage 6:python3-defusedxml-0.6.0-1.5.1 SUSE Enterprise Storage 6:python3-freezegun-0.3.12-1.5.1 SUSE Enterprise Storage 6:python3-isodate-0.6.0-1.3.2 SUSE Enterprise Storage 6:python3-pkgconfig-1.5.1-1.5.1 SUSE Enterprise Storage 6:python3-python3-saml-1.9.0-1.5.2 SUSE Enterprise Storage 6:python3-xmlsec-1.3.6-1.5.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:python3-python3-saml-1.7.0-1.45 SUSE Linux Enterprise Module for Basesystem 15 SP3:python3-python3-saml-1.7.0-1.45 SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-python3-saml-1.7.0-150400.8.4 SUSE Linux Enterprise Module for Basesystem 15 SP5:python3-python3-saml-1.7.0-150400.8.4 SUSE Linux Enterprise Module for Basesystem 15 SP6:python3-python3-saml-1.7.0-150400.12.69 SUSE Linux Enterprise Module for Basesystem 15 SP7:python3-python3-saml-1.7.0-150400.12.69 openSUSE Tumbleweed:python310-python3-saml-1.15.0-2.3 openSUSE Tumbleweed:python311-python3-saml-1.15.0-2.3 openSUSE Tumbleweed:python312-python3-saml-1.15.0-2.3 openSUSE Tumbleweed:python36-python3-saml-1.11.0-1.2 openSUSE Tumbleweed:python38-python3-saml-1.11.0-1.2 openSUSE Tumbleweed:python39-python3-saml-1.11.0-1.2 SUSE Linux Enterprise Module for Basesystem 15 SP2:python-python3-saml SUSE Linux Enterprise Module for Basesystem 15 SP2:python3-python3-saml critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H