Description
A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Entr'ouvert | Lasso | 2.5.1, 2.8.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lasso | 2.9.0-1 | — |
| Debian 13 | lasso | 2.8.2-9+deb13u1 | DSA-6058-1 |
| Debian 12 | lasso | 2.8.1-1+deb12u1 | DSA-6058-1 |
| Debian 11 | lasso | 2.6.1-3+deb11u1 | DLA-4397-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | lasso | 2.8.2-2ubuntu0.1 | USN-7872-1 |
| Ubuntu 22.04 LTS | lasso | 2.7.0-2ubuntu0.1 | USN-7872-1 |
| Ubuntu 20.04 LTS | lasso | No fix yet | — |
| Ubuntu 18.04 LTS | lasso | No fix yet | — |
| Ubuntu 16.04 LTS | lasso | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | lasso +2 | 2.7.0-11.el9_7.3 | RHSA-2025:21462 |
| RHEL 8 | lasso +2 | 2.6.0-14.el8_10 | RHSA-2025:21628 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.6 EUS | lasso +2 | 2.7.0-11.el9_6.2 | RHSA-2025:21452 |
| RHEL 9.4 EUS | lasso +2 | 2.7.0-11.el9_4.1 | RHSA-2025:21403 |
| RHEL 9.2 E4S | lasso +1 | 2.7.0-11.el9_2.1 | RHSA-2025:21406 |
| RHEL 9.0 E4S | lasso | 2.7.0-9.el9_0.1 | RHSA-2025:21405 |
| RHEL 8.8 TUS | lasso +1 | 2.6.0-13.el8_8.1 | RHSA-2025:21400 |
| RHEL 8.8 E4S | lasso +1 | 2.6.0-13.el8_8.1 | RHSA-2025:21400 |
| RHEL 8.6 TUS | lasso | 2.6.0-12.el8_6.1 | RHSA-2025:21401 |
| RHEL 8.6 E4S | lasso | 2.6.0-12.el8_6.1 | RHSA-2025:21401 |
| RHEL 8.6 AUS | lasso | 2.6.0-12.el8_6.1 | RHSA-2025:21401 |
| RHEL 8.4 EUS Long Life | lasso | 2.6.0-8.el8_4.1 | RHSA-2025:21402 |
| RHEL 8.4 AUS | lasso | 2.6.0-8.el8_4.1 | RHSA-2025:21402 |
| RHEL 8.2 AUS | lasso | 2.6.0-8.el8_2.1 | RHSA-2025:21399 |
| RHEL 7 ELS | lasso +2 | 2.5.1-8.el7_9.1 | RHSA-2025:21404 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | lasso +2 | 2.7.0-11.el9_7.3 | ALSA-2025:21462 |
| AlmaLinux 8 | lasso +2 | 2.6.0-14.el8_10 | ALSA-2025:21628 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | lasso | 2.7.0-11.el9_7.3 | RLSA-2025:21462 |
| Rocky Linux 8 | lasso | 2.6.0-14.el8_10 | RLSA-2025:21628 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | lasso | 2.8.2-150600.3.5.1 | SUSE-SU-2025:4068-1 |
| SLES 15 SP6 | lasso | 2.8.2-150600.3.5.1 | SUSE-SU-2025:4068-1 |
| SLES 15 SP5 | lasso | 2.6.1-150200.24.1 | SUSE-SU-2025:4090-1 |
| SLES 15 SP4 | lasso | 2.6.1-150200.24.1 | SUSE-SU-2025:4090-1 |
| SLES 15 SP3 | lasso | 2.6.1-150200.24.1 | SUSE-SU-2025:4090-1 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | lasso | 2.6.1-8.12.1 | SUSE-SU-2025:4094-1 |
| SLES for SAP 16.0 | lasso | 2.8.2-160000.3.1 | SUSE-SU-2025:21140-1 |
| SLES for SAP 15 SP5 | lasso | 2.6.1-150200.24.1 | SUSE-SU-2025:4090-1 |
| SLES for SAP 15 SP4 | lasso | 2.6.1-150200.24.1 | SUSE-SU-2025:4090-1 |
| SLES for SAP 15 SP3 | lasso | 2.6.1-150200.24.1 | SUSE-SU-2025:4090-1 |
| SLES 16.0 | lasso | 2.8.2-160000.3.1 | SUSE-SU-2025:21140-1 |
| SLE HPC 15 SP5 | lasso | 2.6.1-150200.24.1 | SUSE-SU-2025:4090-1 |
| SLE HPC 15 SP4 | lasso | 2.6.1-150200.24.1 | SUSE-SU-2025:4090-1 |
| SLE HPC 15 SP3 | lasso | 2.6.1-150200.24.1 | SUSE-SU-2025:4090-1 |
| SUSE Manager Server LTS 4.3 | lasso | 2.6.1-150200.24.1 | SUSE-SU-2025:4090-1 |
| SUSE Manager Proxy LTS 4.3 | lasso | 2.6.1-150200.24.1 | SUSE-SU-2025:4090-1 |
| SUSE Enterprise Storage 7.1 | lasso | 2.6.1-150200.24.1 | SUSE-SU-2025:4090-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | lasso | 2.8.2-160000.3.1 | openSUSE-SU-2025:20083-1 |
| openSUSE Leap 15.6 | lasso | 2.8.2-150600.3.5.1 | SUSE-SU-2025:4068-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | lasso +3 | 2.9.0-1.amzn2023 | ALAS2023-2025-1285 |
| Amazon Linux 2 | lasso +2 | 2.9.0-1.amzn2.0.1 | ALAS2-2025-3077 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | lasso | 2.9.0-1 | — |
| Azure Linux 2 (CBL-Mariner) | lasso | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | lasso +2 | 2.7.0-11.el9_7.3 | ELSA-2025-21462 |
| Oracle Linux 8 | lasso +2 | 2.6.0-14.el8_10 | ELSA-2025-21628 |
| Oracle Linux 7 | lasso +2 | 2.5.1-8.0.1.el7_9 | ELSA-2025-21404 |
Advisories 29
- ALSA-2025:21462 Critical: lasso security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:21628 Critical: lasso security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:21628 Red Hat Security Advisory: lasso security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:21462 Red Hat Security Advisory: lasso security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:21452 Red Hat Security Advisory: lasso security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:21406 Red Hat Security Advisory: lasso security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:21404 Red Hat Security Advisory: lasso security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:21405 Red Hat Security Advisory: lasso security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:21401 Red Hat Security Advisory: lasso security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:21402 Red Hat Security Advisory: lasso security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:21403 Red Hat Security Advisory: lasso security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:21400 Red Hat Security Advisory: lasso security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:21399 Red Hat Security Advisory: lasso security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- USN-7872-1 lasso vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2025:20083-1 Security update for lasso SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4068-1 Security update for lasso SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4090-1 Security update for lasso SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21140-1 Security update for lasso SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4094-1 Security update for lasso SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-2607 Red Hat Enterprise Linux (lasso): Eine Schwachstelle ermöglichen Codeausführung BSI CERT-Bund (WID) · Jan 21, 2026
- ELSA-2025-21404 Critical: lasso security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 10, 2025
- DLA-4397-1 lasso - security update Debian Security (DSA / DLA) · Dec 8, 2025
- ELSA-2025-21462 Critical: lasso security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 25, 2025
- RLSA-2025:21462 Critical: lasso security update Rocky Linux Security Advisories · Nov 21, 2025
- ELSA-2025-21628 Critical: lasso security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 19, 2025
- RLSA-2025:21628 Critical: lasso security update Rocky Linux Security Advisories · Nov 18, 2025
- DSA-6058-1 lasso - security update Debian Security (DSA / DLA) · Nov 15, 2025
- ALAS2-2025-3077 Critical: lasso security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 10, 2025
- ALAS2023-2025-1285 Critical: lasso security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 10, 2025