Skip to content

Commit 48addfd

Browse files
committed
Release 2.2.0
1 parent 80fab33 commit 48addfd

File tree

3 files changed

+26
-5
lines changed

3 files changed

+26
-5
lines changed

README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ Python3: [python3-saml](https://github.com/onelogin/python3-saml).
1414

1515
#### Warning ####
1616

17-
Update python-saml to 2.1.9, this version includes a security patch that contains extra validations that will prevent signature wrapping attacks.
17+
Update python-saml to 2.2.0, this version includes a security patch that contains extra validations that will prevent signature wrapping attacks.
1818

19-
python-saml < v2.1.6 is vulnerable and allows signature wrapping!
19+
python-saml < v2.2.0 is vulnerable and allows signature wrapping!
2020

2121
#### Security Guidelines ####
2222

changelog.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,26 @@
11
# python-saml changelog
22

3+
### 2.2.0 (Oct 14, 2016)
4+
* Several security improvements:
5+
* Conditions element required and unique.
6+
* AuthnStatement element required and unique.
7+
* SPNameQualifier must math the SP EntityID
8+
* Reject saml:Attribute element with same “Name” attribute
9+
* Reject empty nameID
10+
* Require Issuer element. (Must match IdP EntityID).
11+
* Destination value can't be blank (if present must match ACS URL).
12+
* Check that the EncryptedAssertion element only contains 1 Assertion element.
13+
* Improve Signature validation process
14+
* [#149](https://github.com/onelogin/python-saml/pull/149) Work-around for xmlsec.initialize
15+
* [#151](https://github.com/onelogin/python-saml/pull/151) Fix flask demo error handling and improve documentation
16+
*
17+
* [#152](https://github.com/onelogin/python-saml/pull/152) Update LICENSE to include MIT rather than BSD license
18+
* [#155](https://github.com/onelogin/python-saml/pull/155) Fix typographical errors in docstring
19+
* Fix RequestedAttribute Issue
20+
* Fix __build_signature method. If relay_state is null not be part of the SignQuery
21+
* [#164](https://github.com/onelogin/python-saml/pull/164) Add support for non-ascii fields in settings
22+
23+
324
### 2.1.9 (Jun 27, 2016)
425
* Change the decrypt assertion process.
526
* Add 2 extra validations to prevent Signature wrapping attacks.

setup.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
setup(
1111
name='python-saml',
12-
version='2.1.9',
12+
version='2.2.0',
1313
description='Onelogin Python Toolkit. Add SAML support to your Python software using this library',
1414
classifiers=[
1515
'Development Status :: 4 - Beta',
@@ -22,9 +22,9 @@
2222
author_email='[email protected]',
2323
license='MIT',
2424
url='https://github.com/onelogin/python-saml',
25-
packages=['onelogin','onelogin/saml2'],
25+
packages=['onelogin', 'onelogin/saml2'],
2626
include_package_data=True,
27-
package_data = {
27+
package_data={
2828
'onelogin/saml2/schemas': ['*.xsd'],
2929
},
3030
package_dir={

0 commit comments

Comments
 (0)