File tree Expand file tree Collapse file tree 3 files changed +26
-5
lines changed
Expand file tree Collapse file tree 3 files changed +26
-5
lines changed Original file line number Diff line number Diff line change @@ -14,9 +14,9 @@ Python3: [python3-saml](https://github.com/onelogin/python3-saml).
1414
1515#### Warning ####
1616
17- Update python-saml to 2.1.9 , this version includes a security patch that contains extra validations that will prevent signature wrapping attacks.
17+ Update python-saml to 2.2.0 , this version includes a security patch that contains extra validations that will prevent signature wrapping attacks.
1818
19- python-saml < v2.1.6 is vulnerable and allows signature wrapping!
19+ python-saml < v2.2.0 is vulnerable and allows signature wrapping!
2020
2121#### Security Guidelines ####
2222
Original file line number Diff line number Diff line change 11# python-saml changelog
22
3+ ### 2.2.0 (Oct 14, 2016)
4+ * Several security improvements:
5+ * Conditions element required and unique.
6+ * AuthnStatement element required and unique.
7+ * SPNameQualifier must math the SP EntityID
8+ * Reject saml: Attribute element with same “Name” attribute
9+ * Reject empty nameID
10+ * Require Issuer element. (Must match IdP EntityID).
11+ * Destination value can't be blank (if present must match ACS URL).
12+ * Check that the EncryptedAssertion element only contains 1 Assertion element.
13+ * Improve Signature validation process
14+ * [ #149 ] ( https://github.com/onelogin/python-saml/pull/149 ) Work-around for xmlsec.initialize
15+ * [ #151 ] ( https://github.com/onelogin/python-saml/pull/151 ) Fix flask demo error handling and improve documentation
16+ *
17+ * [ #152 ] ( https://github.com/onelogin/python-saml/pull/152 ) Update LICENSE to include MIT rather than BSD license
18+ * [ #155 ] ( https://github.com/onelogin/python-saml/pull/155 ) Fix typographical errors in docstring
19+ * Fix RequestedAttribute Issue
20+ * Fix __ build_signature method. If relay_state is null not be part of the SignQuery
21+ * [ #164 ] ( https://github.com/onelogin/python-saml/pull/164 ) Add support for non-ascii fields in settings
22+
23+
324### 2.1.9 (Jun 27, 2016)
425* Change the decrypt assertion process.
526* Add 2 extra validations to prevent Signature wrapping attacks.
Original file line number Diff line number Diff line change 99
1010setup (
1111 name = 'python-saml' ,
12- version = '2.1.9 ' ,
12+ version = '2.2.0 ' ,
1313 description = 'Onelogin Python Toolkit. Add SAML support to your Python software using this library' ,
1414 classifiers = [
1515 'Development Status :: 4 - Beta' ,
22222323 license = 'MIT' ,
2424 url = 'https://github.com/onelogin/python-saml' ,
25- packages = ['onelogin' ,'onelogin/saml2' ],
25+ packages = ['onelogin' , 'onelogin/saml2' ],
2626 include_package_data = True ,
27- package_data = {
27+ package_data = {
2828 'onelogin/saml2/schemas' : ['*.xsd' ],
2929 },
3030 package_dir = {
You can’t perform that action at this time.
0 commit comments