CVE catalog
CVE-2016-10127
python-pysaml2: CVE-2016-10127
- Severity
- Critical · CVSS 9
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.62% · Oct 25, 2026
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-pysaml2 | sid | 7.5.4-3 | vulnerable |
| Debian | python-pysaml2 | forky | 7.5.4-3 | vulnerable |
| Debian | python-pysaml2 | trixie | 7.5.0-4 | vulnerable |
| Debian | python-pysaml2 | bookworm | 7.0.1-2 | vulnerable |
| Suse | crowbar-core | openstack cloud 7 | 4.0+git.1570463621.40b11cd48-9.54.1 | fixed |
| Suse | crowbar-openstack | openstack cloud 7 | 4.0+git.1569429513.e7016b2b6-9.59.1 | fixed |
| Suse | grafana | openstack cloud 7 | 4.6.5-1.11.2 | fixed |
| Suse | novnc | openstack cloud 7 | 1.0.0-12.1 | fixed |
| Suse | openstack-keystone | openstack cloud 7 | 10.0.3~dev9-7.18.2 | fixed |
| Suse | openstack-keystone-doc | openstack cloud 7 | 10.0.3~dev9-7.18.2 | fixed |
| Suse | openstack-neutron | openstack cloud 7 | 9.4.2~dev21-7.32.1 | fixed |
| Suse | openstack-neutron-doc | openstack cloud 7 | 9.4.2~dev21-7.32.1 | fixed |
| Suse | openstack-neutron-lbaas | openstack cloud 7 | 9.2.2~dev11-4.18.3 | fixed |
| Suse | openstack-neutron-lbaas-doc | openstack cloud 7 | 9.2.2~dev11-4.18.3 | fixed |
| Suse | openstack-nova | openstack cloud 7 | 14.0.11~dev13-4.34.3 | fixed |
| Suse | openstack-nova-doc | openstack cloud 7 | 14.0.11~dev13-4.34.2 | fixed |
| Suse | openstack-tempest | openstack cloud 7 | 12.2.1~a0~dev177-4.6.3 | fixed |
| Suse | python-pysaml2 | openstack cloud 7 | 4.0.2-3.11.3 | fixed |
| Suse | python-urllib3 | openstack cloud 7 | 1.16-3.9.2 | fixed |
| Suse | rubygem-chef | openstack cloud 7 | 10.32.2-5.12.1 | fixed |
| Suse | rubygem-easy_diff | openstack cloud 7 | 1.0.0-3.3.1 | fixed |
| Suse | sleshammer | openstack cloud 7 | 0.7.0-0.18.12.3 | fixed |
| Suse | crowbar-core | enterprise storage 4 | 4.0+git.1570463621.40b11cd48-9.54.1 | fixed |
| Suse | rubygem-chef | enterprise storage 4 | 10.32.2-5.12.1 | fixed |
| Suse | rubygem-easy_diff | enterprise storage 4 | 1.0.0-3.3.1 | fixed |
| Suse | sleshammer | enterprise storage 4 | 0.7.0-0.18.12.3 | fixed |
| Suse | python-defusedxml | openstack cloud 6 | 0.4.1-2.1 | fixed |
| Suse | python-pysaml2 | openstack cloud 6 | 2.4.0-3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-pysaml2 | source | sid | (unfixed) | unimportant | Not reported | [859135] |
| Debian | python-pysaml2 | source | forky | (unfixed) | unimportant | Not reported | [859135] |
| Debian | python-pysaml2 | source | trixie | (unfixed) | unimportant | Not reported | [859135] |
| Debian | python-pysaml2 | source | bookworm | (unfixed) | unimportant | Not reported | [859135] |
| Suse | crowbar-core | rpm | openstack cloud 7 | 4.0+git.1570463621.40b11cd48-9.54.1 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | crowbar-openstack | rpm | openstack cloud 7 | 4.0+git.1569429513.e7016b2b6-9.59.1 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | grafana | rpm | openstack cloud 7 | 4.6.5-1.11.2 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | novnc | rpm | openstack cloud 7 | 1.0.0-12.1 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | openstack-keystone | rpm | openstack cloud 7 | 10.0.3~dev9-7.18.2 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | openstack-keystone-doc | rpm | openstack cloud 7 | 10.0.3~dev9-7.18.2 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | openstack-neutron | rpm | openstack cloud 7 | 9.4.2~dev21-7.32.1 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | openstack-neutron-doc | rpm | openstack cloud 7 | 9.4.2~dev21-7.32.1 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | openstack-neutron-lbaas | rpm | openstack cloud 7 | 9.2.2~dev11-4.18.3 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | openstack-neutron-lbaas-doc | rpm | openstack cloud 7 | 9.2.2~dev11-4.18.3 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | openstack-nova | rpm | openstack cloud 7 | 14.0.11~dev13-4.34.3 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | openstack-nova-doc | rpm | openstack cloud 7 | 14.0.11~dev13-4.34.2 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | openstack-tempest | rpm | openstack cloud 7 | 12.2.1~a0~dev177-4.6.3 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | python-pysaml2 | rpm | openstack cloud 7 | 4.0.2-3.11.3 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | python-urllib3 | rpm | openstack cloud 7 | 1.16-3.9.2 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | rubygem-chef | rpm | openstack cloud 7 | 10.32.2-5.12.1 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | rubygem-easy_diff | rpm | openstack cloud 7 | 1.0.0-3.3.1 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | sleshammer | rpm | openstack cloud 7 | 0.7.0-0.18.12.3 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | crowbar-core | rpm | enterprise storage 4 | 4.0+git.1570463621.40b11cd48-9.54.1 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | rubygem-chef | rpm | enterprise storage 4 | 10.32.2-5.12.1 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | rubygem-easy_diff | rpm | enterprise storage 4 | 1.0.0-3.3.1 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | sleshammer | rpm | enterprise storage 4 | 0.7.0-0.18.12.3 | Not reported | SUSE-SU-2019:2671-1 | Not reported |
| Suse | python-defusedxml | rpm | openstack cloud 6 | 0.4.1-2.1 | Not reported | SUSE-SU-2017:0569-1 | Not reported |
| Suse | python-pysaml2 | rpm | openstack cloud 6 | 2.4.0-3.1 | Not reported | SUSE-SU-2017:0569-1 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [python3-pysaml2]Unknown
Source package: [python-pysaml2]
Details (2)
7.0.1-2· all · bookwormAffected
dsa · python-pysaml2 · debian · bookworm; dsa · python-pysaml2 · debian · 12
7.0.1-2· all · bookwormAffected
dsa · python-pysaml2 · debian · bookworm; dsa · python-pysaml2 · debian · 12
- [python-pysaml2-doc]Unknown
Source package: [python-pysaml2]
Details (2)
7.0.1-2· all · bookwormAffected
dsa · python-pysaml2 · debian · bookworm; dsa · python-pysaml2 · debian · 12
7.0.1-2· all · bookwormAffected
dsa · python-pysaml2 · debian · bookworm; dsa · python-pysaml2 · debian · 12
[Debian 13 (Trixie)]
- [python3-pysaml2]Unknown
Source package: [python-pysaml2]
Details (2)
7.5.0-4· all · trixieAffected
dsa · python-pysaml2 · debian · 13
7.5.0-4· all · trixieAffected
dsa · python-pysaml2 · debian · 13
- [python-pysaml2-doc]Unknown
Source package: [python-pysaml2]
Details (2)
7.5.0-4· all · trixieAffected
dsa · python-pysaml2 · debian · 13
7.5.0-4· all · trixieAffected
dsa · python-pysaml2 · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_0569-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2016-10127]
- [https://osv.dev/vulnerability/SUSE-SU-2017:0569-1]
- [https://osv.dev/vulnerability/SUSE-SU-2019:2671-1]
- [https://security-tracker.debian.org/tracker/CVE-2016-10127]
- [https://security.access.redhat.com/data/csaf/v2/vex/2016/cve-2016-10127.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]