Amazon Linux AMI : lasso (ALAS-2021-1529)

The version of lasso installed on the remote host is prior to 2.5.1-8.6. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1529 advisory. An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to...

Important: lasso

Issue Overview: An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to include an unsigned SAML assertion, which may be used to impersonate another valid user recognized by the service using Lasso. The highest threat from th...

EulerOS 2.0 SP5 : lasso (EulerOS-SA-2021-2337)

According to the version of the lasso packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.CVE-2021-28091 Note that Tenable Network Security has...

Huawei EulerOS: Security Advisory for lasso (EulerOS-SA-2021-2337)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Insecure Cryptographic Function

Lasso has insecure cryptographic functions. The vulnerability exists due to the lack of sanitization in the modauthmellon...

RHEL 7 : lasso (RHSA-2021:2989)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2989 advisory. The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2...

SUSE: Security Advisory (SUSE-SU-2021:2589-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Scientific Linux Security Update : lasso on SL7.x i686/x86_64 (2021:2989)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:2989-1 advisory. - lasso: XML signature wrapping vulnerability when parsing SAML responses CVE-2021-28091 Note that Nessus has not tested for this issue but has instead...

SUSE SLED12 / SLES12 Security Update : lasso (SUSE-SU-2021:2589-1)

The remote SUSE Linux SLED12 / SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2589-1 advisory. - CVE-2021-28091: Fixed XML signature wrapping vulnerability when parsing SAML responses. bsc1186768 Tenable has extracted the...

lasso: XML signature wrapping vulnerability when parsing SAML responses

An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to include an unsigned SAML assertion, which may be used to impersonate another valid user recognized by the service using Lasso. The highest threat from this vulnerability...

Important: Red Hat Security Advisory: lasso security update

An update for lasso is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Oracle Linux 7 : lasso (ELSA-2021-2989)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2989 advisory. - Related: 1963855 - CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses - Related: 1963855 - CVE-2021-28091 lasso: XML...

lasso security update

2.5.1-8 - Fix Coverity warning introduced by the previous patch - Related: 1963855 - CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses 2.5.1-7 - Fix Coverity warning introduced by the previous patch - Related: 1963855 - CVE-2021-28091 lasso: XML signature...

Security update for lasso (important)

openSUSE Security Update: Security update for lasso Announcement ID: openSUSE-SU-2021:1057-1 Rating: important References: 1186768 Cross-References: CVE-2021-28091 CVSS scores: CVE-2021-28091 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-28091 SUSE: 8.8...

openSUSE: Security Advisory for lasso (openSUSE-SU-2021:1057-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE 15 Security Update : lasso (openSUSE-SU-2021:1057-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1057-1 advisory. - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. CVE-2021-28091 Note that Nessus has not tested for this...

OPENSUSE-SU-2021:1057-1 Security update for lasso

This update for lasso fixes the following issues: - CVE-2021-28091: Fixed XML signature wrapping vulnerability when parsing SAML responses boo1186768...

Amazon Linux 2 : lasso (ALAS-2021-1660)

The version of lasso installed on the remote host is prior to 2.5.1-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1660 advisory. An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to inclu...

Important: lasso

Issue Overview: An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to include an unsigned SAML assertion, which may be used to impersonate another valid user recognized by the service using Lasso. The highest threat from th...

Fedora: Security Advisory for lasso (FEDORA-2021-508acb1153)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...