CVE-2017-1000246

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.

Score

CVSS 3.0 5.3 Medium

Status

Modified - cve@mitre.org

Published

2017-11-17

Last modified

2024-09-17

Weaknesses

CWE-330

Affected products

• Pysaml2 (Pysaml2 Project)

References

• https://github.com/rohe/pysaml2/issues/417