CVE-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

DEBIAN-CVE-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

CVE-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

Design/Logic Flaw

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

CVE-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

CVE-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

CVE-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

CVE-2021-28091

CVE-2021-28091 affects the Lasso library. All versions prior to 2.7.0 are vulnerable due to improper verification of a cryptographic signature in SAML/XML signature processing, which can allow manipulation of SAML responses and potential impersonation. Remediation is to upgrade to version 2.7.0 o...

[SECURITY] [DSA 4926-1] lasso security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4926-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 03, 2021 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4926-1] lasso security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4926-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 03, 2021 https://www.debian.org/security/faq -...

Ubuntu: Security Advisory (USN-4974-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DSA-4926-1 lasso - security update

Bulletin has no description...

USN-4974-1 lasso vulnerability

It was discovered that Lasso did not properly verify that all assertions in a SAML response were properly signed. An attacker could possibly use this to impersonate users or otherwise bypass access controls...

USN-4974-1: Lasso vulnerability

It was discovered that Lasso did not properly verify that all assertions in a SAML response were properly signed. An attacker could possibly use this to impersonate users or otherwise bypass access controls...

Ubuntu 18.04 LTS / 20.04 LTS : Lasso vulnerability (USN-4974-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4974-1 advisory. It was discovered that Lasso did not properly verify that all assertions in a SAML response were properly signed. An attacker could possibly use this ...

CVE-2021-28091

An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to include an unsigned SAML assertion, which may be used to impersonate another valid user recognized by the service using Lasso. The highest threat from this vulnerability...

SOGo and PacketFence Impacted by SAML Implementation Vulnerabilities

Part of Akamai's incident management process for vulnerabilities in third party software involves verifying potential impact in other systems using the same or similar libraries. While following that process when addressing the SAML impersonation vulnerability, CVE-2021-28091, which impacted...

Akamai EAA Impersonation Vulnerability - A Deep Dive

In this post, we cover the technical details of CVE-2021-28091, the vulnerability impacting Akamai's Enterprise Application Access EAA platform. We cover our investigation, remediation and disclosure process for the vulnerability. For an overview of the vulnerability, the impact to Akamai, the...

SAML Implementation Vulnerability Impacting Some Akamai Services

This blog post provides an overview of a vulnerability discovered in Akamai's Enterprise Application Access EAA product which has been patched. This vulnerability could have allowed an actor to impersonate an authorized user when interacting with an application that used Security Assertion Markup...

Lasso SAML Implementation Vulnerability Affecting Cisco Products: June 2021

On June 1, 2021, Lasso disclosed a security vulnerability in the Lasso Security Assertion Markup Language SAML Single Sign-On SSO library. This vulnerability could allow an authenticated attacker to impersonate another authorized user when interacting with an application. For a description of thi...