CVSS 3.0
5.3 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2017-1000246
Medium (5.3) in pysaml2 project pysaml2. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in pysaml2 4.6.0.
Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
- CWE
- CWE-330
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pysaml2_project:pysaml2
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cq94-qf6q-mf2h | PyPI | pysaml2 | <4.6.0 | 4.6.0 |
| PYSEC-2017-26 | PyPI | pysaml2 | <4.6.0 | 4.6.0 |