ALSA-2021:4325 Moderate: lasso security and enhancement update

The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages. Security Fixes: lasso: XML...

Huawei EulerOS: Security Advisory for lasso (EulerOS-SA-2021-2589)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : lasso (EulerOS-SA-2021-2589)

According to the versions of the lasso packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. CVE-2021-28091 Note that Tenable Network Security has...

EulerOS 2.0 SP8 : lasso (EulerOS-SA-2021-2467)

According to the versions of the lasso package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. CVE-2021-28091 Note that Tenable Network Security has...

Huawei EulerOS: Security Advisory for lasso (EulerOS-SA-2021-2467)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for lasso (EulerOS-SA-2021-2393)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP2 : lasso (EulerOS-SA-2021-2393)

According to the version of the lasso packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.CVE-2021-28091 Note that Tenable Network Security has...

Amazon Linux AMI : lasso (ALAS-2021-1529)

The version of lasso installed on the remote host is prior to 2.5.1-8.6. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1529 advisory. An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to...

Important: lasso

Issue Overview: An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to include an unsigned SAML assertion, which may be used to impersonate another valid user recognized by the service using Lasso. The highest threat from th...

EulerOS 2.0 SP5 : lasso (EulerOS-SA-2021-2337)

According to the version of the lasso packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.CVE-2021-28091 Note that Tenable Network Security has...

Huawei EulerOS: Security Advisory for lasso (EulerOS-SA-2021-2337)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Insecure Cryptographic Function

Lasso has insecure cryptographic functions. The vulnerability exists due to the lack of sanitization in the modauthmellon...

RHEL 7 : lasso (RHSA-2021:2989)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2989 advisory. The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2...

SUSE: Security Advisory (SUSE-SU-2021:2589-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Scientific Linux Security Update : lasso on SL7.x i686/x86_64 (2021:2989)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:2989-1 advisory. - lasso: XML signature wrapping vulnerability when parsing SAML responses CVE-2021-28091 Note that Nessus has not tested for this issue but has instead...

SUSE SLED12 / SLES12 Security Update : lasso (SUSE-SU-2021:2589-1)

The remote SUSE Linux SLED12 / SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2589-1 advisory. - CVE-2021-28091: Fixed XML signature wrapping vulnerability when parsing SAML responses. bsc1186768 Tenable has extracted the...

Important: Red Hat Security Advisory: lasso security update

An update for lasso is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

lasso: XML signature wrapping vulnerability when parsing SAML responses

An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to include an unsigned SAML assertion, which may be used to impersonate another valid user recognized by the service using Lasso. The highest threat from this vulnerability...

lasso security update

2.5.1-8 - Fix Coverity warning introduced by the previous patch - Related: 1963855 - CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses 2.5.1-7 - Fix Coverity warning introduced by the previous patch - Related: 1963855 - CVE-2021-28091 lasso: XML signature...

Oracle Linux 7 : lasso (ELSA-2021-2989)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2989 advisory. - Related: 1963855 - CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses - Related: 1963855 - CVE-2021-28091 lasso: XML...