Skip to content

Conversation

@WebSpider
Copy link
Contributor

Pysaml2 tagged a release about a week ago. My tests find it to be compatible, and it solves quite a few bugs.

Let's use it in djangosaml2 as well

@knaperek
Copy link
Collaborator

knaperek commented Nov 2, 2017

Thanks, I already have a branch open for this; just need to fix some tests on Python 3 first.
Interestingly, Travis did not pick up this PR...

@utek
Copy link

utek commented Feb 22, 2018

Any progress on this PR?

safety (pyup.io) is reporting 2 security issues with version 4.4.0 and it would be great if we could update version used in djangosaml2:

pysaml2                    │ 4.4.0     │ <=4.4.0                  │ 35700    │
pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password. 


pysaml2                    │ 4.4.0     │ <=4.4.0                  │ 35699    │
Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.

@knaperek
Copy link
Collaborator

Didn't have time to look at this, but this PR breaks the tests on Python3. For some reason this PR was not picked up by Travis, but check my upgrade-pysaml2 branch. Will be happy to accept a patch for this should you figure out how to fix it :-)

@GertBurger
Copy link
Contributor

@knaperek I attempted to run the py3 tests locally and I could not get them to succeed on the master branch so I have a feeling the version bump didn't cause it. No idea why travis tests passed though.

@vkurup
Copy link
Contributor

vkurup commented May 18, 2018

Hi @knaperek, I've submitted a version that gets tests to pass in #122.

@WebSpider
Copy link
Contributor Author

Closing this as it is solved in #122

@WebSpider WebSpider closed this May 30, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants