CVE-2020-5390: Improper Verification of Cryptographic Signature
(updated )
PySAML2 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i. The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertion that have been signed.
References
Detect and mitigate CVE-2020-5390 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →