Summary
It was discovered that Lasso did not properly verify that all
assertions in a SAML response were properly signed. An attacker
could possibly use this to impersonate users or otherwise bypass
access controls.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | lasso | 2.5.1-0ubuntu1.2 |
| Ubuntu · 20.04 LTS 20.04:LTS | lasso | 2.6.0-7ubuntu1.2 |
Vulnerabilities 1
-
Unscored —
Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.
References
-
report
https://ubuntu.com/security/CVE-2021-28091