Most recent entries from all

ALSA-2021:4325 — Moderate: lasso security and enhancement update

Affected: AlmaLinux:8: lasso, AlmaLinux:8: lasso-devel

The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages.

Security Fix(es):

* lasso: XML signature wrapping vulnerability when parsing SAML responses (CVE-2021-28091)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-02957

certfr-2021-avi-422 — Une vulnérabilité a été découverte dans les produits Cisco. Elle permet à un attaquant de provoquer un contournement de…

certfr-2021-avi-422

cisco-sa-lasso-saml-jun2021-DOXNRLkD — Lasso SAML Implementation Vulnerability Affecting Cisco Products: June 2021

On June 1, 2021, Lasso disclosed a security vulnerability in the Lasso Security Assertion Markup Language (SAML) Single Sign-On (SSO) library. This vulnerability could allow an authenticated attacker to impersonate another authorized user when interacting with an application. For a description of this vulnerability, see lasso.git NEWS ["https://git.entrouvert.org/lasso.git/tree/NEWS?id=v2.7.0"]. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lasso-saml-jun2021-DOXNRLkD ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lasso-saml-jun2021-DOXNRLkD"]

EUVD-2026-25835

fkie_cve-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.

GHSA-5pxh-5p72-wvcm

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.

gsd-2021-28091

msrc_CVE-2021-28091 — Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.

msrc_CVE-2021-28091

openSUSE-SU-2021:1057-1 — Security update for lasso

Security update for lasso

SUSE-SU-2021:2589-1 — Security update for lasso

Security update for lasso

UBUNTU-CVE-2021-28091

Affected: Ubuntu:16.04:LTS: lasso, Ubuntu:18.04:LTS: lasso, Ubuntu:20.04:LTS: lasso

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.