355 matches found
openSUSE 15 Security Update : lasso (openSUSE-SU-2021:1057-1)
The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1057-1 advisory. - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. CVE-2021-28091 Note that Nessus has not tested for this...
openSUSE: Security Advisory for lasso (openSUSE-SU-2021:1057-1)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Security update for lasso (important)
openSUSE Security Update: Security update for lasso Announcement ID: openSUSE-SU-2021:1057-1 Rating: important References: 1186768 Cross-References: CVE-2021-28091 CVSS scores: CVE-2021-28091 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-28091 SUSE: 8.8...
OPENSUSE-SU-2021:1057-1 Security update for lasso
This update for lasso fixes the following issues: - CVE-2021-28091: Fixed XML signature wrapping vulnerability when parsing SAML responses boo1186768...
Amazon Linux 2 : lasso (ALAS-2021-1660)
The version of lasso installed on the remote host is prior to 2.5.1-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1660 advisory. An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to inclu...
Important: lasso
Issue Overview: An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to include an unsigned SAML assertion, which may be used to impersonate another valid user recognized by the service using Lasso. The highest threat from th...
Fedora: Security Advisory for lasso (FEDORA-2021-bb3ea1e191)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for lasso (FEDORA-2021-508acb1153)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 33 Update: lasso-2.7.0-1.fc33
Lasso is a library that implements the Liberty Alliance Single Sign On standards, including the SAML and SAML2 specifications. It allows to handle the whole life-cycle of SAML based Federations, and provides bindings for multiple languages...
[SECURITY] Fedora 34 Update: lasso-2.7.0-1.fc34
Lasso is a library that implements the Liberty Alliance Single Sign On standards, including the SAML and SAML2 specifications. It allows to handle the whole life-cycle of SAML based Federations, and provides bindings for multiple languages...
Debian: Security Advisory (DLA-2684-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DLA-2684-1 : lasso security update
A vulnerability was discovered in lasso, a library for Liberty Alliance and SAML protocols, which results to a improper verification of a cryptographic signature. For Debian 9 stretch, this problem has been fixed in version 2.5.0-5+deb9u1. We recommend that you upgrade your lasso packages. For th...
[SECURITY] [DLA 2684-1] lasso security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-2684-1 [email protected] https://www.debian.org/lts/security/ Yadd June 10, 2021 https://wiki.debian.org/LTS - -------------------------------------------------------------------------...
DLA-2684-1 lasso - security update
Bulletin has no description...
The vulnerability of the Lasso library, related to insecure management of privileges, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the Lasso library is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker, operating remotely, to compromise the confidentiality, integrity, and accessibility of the protected information...
SOGo < 2.4.1, 3.x < 5.1.1 Multiple Vulnerabilities
SOGo is prone to multiple vulnerabilities in SAML. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:alinto:sogo"; if description...
Debian DSA-4926-1 : lasso - security update
It was discovered that lasso, a library which implements SAML 2.0 and Liberty Alliance standards, did not properly verify that all assertions in a SAML response were properly signed, allowing an attacker to impersonate users or bypass access control. %NASLMINLEVEL 70300 C Tenable Network Security...
FreeBSD : lasso -- signature checking failure (417de1e6-c31b-11eb-9633-b42e99a1b9c3)
entrouvert reports : When AuthnResponse messages are not signed which is permitted by the specifiation, all assertion's signatures should be checked, but currently after the first signed assertion is checked all following assertions are accepted without checking their signature, and the last one ...
Debian: Security Advisory (DSA-4926-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
AZL-7255 CVE-2021-28091 affecting package lasso for versions less than 2.8.0-1
Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...