Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-21220 State: PUBLISHED Published: 2021-04-26T00:00:00.000Z Last Updated: 2025-10-21T23:25:48.124Z Vendors: Google Products: Chrome Problem Types: Insufficient validation of untrusted input Description: Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop.html - https://crbug.com/1196683 - https://security.gentoo.org/glsa/202104-08 - http://packetstormsecurity.com/files/162437/Google-C
://crbug.com/1196683 - https://security.gentoo.org/glsa/202104-08 - http://packetstormsecurity.com/files/162437/Google-Chrome-XOR-Typer-Out-Of-Bounds-Access-Remote-Code-Execution.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/ - http://packetstormsecurity.com/files/176210/Chrome-V8-JIT-XOR-Arbitrary-Code-Execution.html
CVE ID: CVE-2021-21221 State: PUBLISHED Published: 2021-04-26T16:26:05 Last Updated: 2024-08-03T18:01:14.525Z Vendors: Google Products: Chrome Problem Types: Insufficient validation of untrusted input Description: Insufficient validation of untrusted input in Mojo in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html - https://crbug.com/1195333 - https://www.debian.org/security/2021/dsa-4906 - https://security.gentoo.org/glsa/202104-08 - ht
ps://crbug.com/1195333 - https://www.debian.org/security/2021/dsa-4906 - https://security.gentoo.org/glsa/202104-08 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
CVE ID: CVE-2021-21222 State: PUBLISHED Published: 2021-04-26T16:56:08 Last Updated: 2024-08-03T18:01:14.515Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/1194046 - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html - https://www.debian.org/security/2021/dsa-4906 - https://security.gentoo.org/glsa/202104-08 - https://lists.fedoraproject.org/archives/list/pac
/security/2021/dsa-4906 - https://security.gentoo.org/glsa/202104-08 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
CVE ID: CVE-2021-21223 State: PUBLISHED Published: 2021-04-26T16:56:08 Last Updated: 2024-08-03T18:01:14.351Z Vendors: Google Products: Chrome Problem Types: Integer overflow Description: Integer overflow in Mojo in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html - https://crbug.com/1195308 - https://www.debian.org/security/2021/dsa-4906 - https://security.gentoo.org/glsa/202104-08 - https://lists.fedoraproject.org/archives
ebian.org/security/2021/dsa-4906 - https://security.gentoo.org/glsa/202104-08 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
CVE ID: CVE-2021-21224 State: PUBLISHED Published: 2021-04-26T16:56:09.000Z Last Updated: 2025-10-21T23:25:47.768Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html - https://crbug.com/1195777 - https://www.debian.org/security/2021/dsa-4906 - https://security.gentoo.org/glsa/202104-08 - https://lists.fedoraproject.org/archives/list/package-
rity/2021/dsa-4906 - https://security.gentoo.org/glsa/202104-08 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
CVE ID: CVE-2021-21225 State: PUBLISHED Published: 2021-04-26T16:56:10 Last Updated: 2024-08-03T18:01:14.523Z Vendors: Google Products: Chrome Problem Types: Out of bounds memory access Description: Out of bounds memory access in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html - https://crbug.com/1195977 - https://www.debian.org/security/2021/dsa-4906 - https://security.gentoo.org/glsa/202104-08 - https://lists.fedoraproject.org/archives/list/package-announce
1/dsa-4906 - https://security.gentoo.org/glsa/202104-08 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
CVE ID: CVE-2021-21226 State: PUBLISHED Published: 2021-04-26T16:56:10 Last Updated: 2024-08-03T18:09:14.962Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in navigation in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html - https://crbug.com/1197904 - https://www.debian.org/security/2021/dsa-4906 - https://security.gentoo.org/glsa/202104-08 - https://lists.fedoraproject.org/archiv
.debian.org/security/2021/dsa-4906 - https://security.gentoo.org/glsa/202104-08 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
CVE ID: CVE-2021-21227 State: PUBLISHED Published: 2021-04-30T20:15:28 Last Updated: 2024-08-03T18:09:14.626Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/1199345 - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html - https://security.gentoo.org/glsa/202104-08 - https://www.debian.org/security/2021/dsa-4911 - https://lists.fedoraproject.org/archives/list/package-announ
202104-08 - https://www.debian.org/security/2021/dsa-4911 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
CVE ID: CVE-2021-21228 State: PUBLISHED Published: 2021-04-30T20:15:29 Last Updated: 2024-08-03T18:09:14.852Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html - https://crbug.com/1139156 - https://security.gentoo.org/glsa/202104-08 - https://www.debian.org/security/2021/dsa-491
- https://crbug.com/1139156 - https://security.gentoo.org/glsa/202104-08 - https://www.debian.org/security/2021/dsa-4911 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
CVE ID: CVE-2021-21229 State: PUBLISHED Published: 2021-04-30T20:15:30 Last Updated: 2024-08-03T18:09:15.130Z Vendors: Google Products: Chrome Problem Types: Incorrect security UI Description: Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html - https://crbug.com/1198165 - https://security.gentoo.org/glsa/202104-08 - https://www.debian.org/security/2021/dsa-4911 - https://lists.fedoraproject.org/archives/list/package-announce%40lis
8 - https://www.debian.org/security/2021/dsa-4911 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
CVE ID: CVE-2021-21230 State: PUBLISHED Published: 2021-04-30T20:15:30 Last Updated: 2024-08-03T18:09:15.074Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html - https://crbug.com/1198705 - https://security.gentoo.org/glsa/202104-08 - https://www.debian.org/security/2021/dsa-4911 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org
an.org/security/2021/dsa-4911 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
CVE ID: CVE-2021-21231 State: PUBLISHED Published: 2021-04-30T20:15:31 Last Updated: 2024-08-03T18:09:14.917Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html - https://crbug.com/1198696 - https://security.gentoo.org/glsa/202104-08 - https://www.debian.org/security/2021/dsa-4911 - https://lists.fedoraproject.org/archives/list/package-announ
CVE ID: CVE-2021-21232 State: PUBLISHED Published: 2021-04-30T20:15:32 Last Updated: 2024-08-03T18:09:14.664Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Dev Tools in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html - https://crbug.com/1175058 - https://security.gentoo.org/glsa/202104-08 - https://www.debian.org/security/2021/dsa-4911 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproj
ww.debian.org/security/2021/dsa-4911 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
CVE ID: CVE-2021-21233 State: PUBLISHED Published: 2021-04-30T20:15:32 Last Updated: 2024-08-03T18:09:14.966Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html - https://crbug.com/1182937 - https://security.gentoo.org/glsa/202104-08 - https://www.debian.org/security/2021/dsa-4911 - https://lists.fedoraproject.org/archives/list/package-announce
2104-08 - https://www.debian.org/security/2021/dsa-4911 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
CVE ID: CVE-2021-21234 State: PUBLISHED Published: 2021-01-05T17:30:15 Last Updated: 2024-08-03T18:09:14.894Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: lukashinsch Products: spring-boot-actuator-logview Problem Types: CWE-22 Description: spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folde
expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other
without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lukashinsch/spring-boot-actuator-logview/security/advisories/GHSA-p4q6-qxjx-8jgp - https://github.com/lukashinsch/spring-boot-actuator-logview/commit/1c76e1ec3588c9f39e1a94bf27b5ff56eb8b17d6
qxjx-8jgp - https://github.com/lukashinsch/spring-boot-actuator-logview/commit/1c76e1ec3588c9f39e1a94bf27b5ff56eb8b17d6 - https://github.com/lukashinsch/spring-boot-actuator-logview/commit/760acbb939a8d1f7d1a7dfcd51ca848eea04e772 - https://search.maven.org/artifact/eu.hinsch/spring-boot-actuator-logview
CVE ID: CVE-2021-21235 State: PUBLISHED Published: 2021-01-06T01:15:14 Last Updated: 2024-08-03T18:09:14.897Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: kamadak Products: exif-rs Problem Types: CWE-400 Description: kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround is available. Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected. Additional Analyst Notes:
hat do not pass files with the PNG signature to Reader::read_from_container are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2 - https://crates.io/crates/kamadak-exif - https://github.com/kamadak/exif-rs/commit/f21df24616ea611c5d5d0e0e2f8042eb74d5ff48
CVE ID: CVE-2021-21236 State: PUBLISHED Published: 2021-01-06T17:00:19 Last Updated: 2024-08-03T18:09:15.166Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Kozea Products: CairoSVG Problem Types: CWE-400 Description: CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very lon
vice (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf - https://pypi.org/project/CairoSVG/ - https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3 - https://github.com/Kozea/CairoSVG/releases/tag/2.5.1
CVE ID: CVE-2021-21237 State: PUBLISHED Published: 2021-01-15T17:36:09 Last Updated: 2024-08-03T18:09:15.015Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: git-lfs Products: git-lfs Problem Types: CWE-426 Description: Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems. This is the result of an incomplete fix for CVE-2020-27955. This issue occurs because on Windows, Go includes (and prefers) the current director
incomplete fix for CVE-2020-27955. This issue occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator. Other than avoiding untrusted repositories or using a different operating system, there is no workaround. This is fixed in v2.13.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/git-lfs/git-lfs/security/advisories/GHSA-cx3w-xqmc-84g5 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27955 - https://github.com/git-lfs/git-lfs/releases/tag/v2.13.2 - https://github.com/git-lfs/git-lfs/commit/fc664697ed2c2081ee9633010de0a7f9debea72a
CVE ID: CVE-2021-21238 State: PUBLISHED Published: 2021-01-21T14:15:27 Last Updated: 2024-08-03T18:09:15.156Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: IdentityPython Products: pysaml2 Problem Types: CWE-347 Description: PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can
date the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/pysaml2 - https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0 - https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9 - https://github.com/IdentityPython/pysaml2/commit/1d8fd268f5bf887480a403a7a5ef8f048157cc14
CVE ID: CVE-2021-21239 State: PUBLISHED Published: 2021-01-21T14:15:21 Last Updated: 2024-08-03T18:09:14.896Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: IdentityPython Products: pysaml2 Problem Types: CWE-347 Description: PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the s