CVE-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.

The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages.

Security Fix(es):

• lasso: XML signature wrapping vulnerability when parsing SAML responses (CVE-2021-28091)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.

The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages.

Security Fix(es):

• lasso: XML signature wrapping vulnerability when parsing SAML responses (CVE-2021-28091)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This update for lasso fixes the following issues:

• CVE-2021-28091: Fixed XML signature wrapping vulnerability when parsing SAML responses (boo#1186768)

These are all security issues fixed in the liblasso-devel-2.7.0-2.2 package on the GA media of openSUSE Tumbleweed.

This update for lasso fixes the following issues:

• CVE-2021-28091: Fixed XML signature wrapping vulnerability when parsing SAML responses. (bsc#1186768)

It was discovered that Lasso did not properly verify that all assertions in a SAML response were properly signed. An attacker could possibly use this to impersonate users or otherwise bypass access controls.