{"id":"CVE-2021-28091","aliases":["ALSA-2021:4325","AZL-7255","DEBIAN-CVE-2021-28091","DLA-2684-1","DSA-4926-1","EUVD-2021-14796","GHSA-5pxh-5p72-wvcm","RHSA-2021:2989","RHSA-2021:4325","RLSA-2021:4325","SUSE-SU-2021:2589-1","UBUNTU-CVE-2021-28091","USN-4974-1","openSUSE-SU-2021:1057-1","openSUSE-SU-2024:10909-1"],"status":"published","title":"Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.","description":"Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01379,"percentile":0.72463,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2021-06-01T12:00:00Z","modified":"2026-10-29T11:01:01Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"lasso","fixed_in":["2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"lasso-devel","fixed_in":["2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"lasso","fixed_in":["2.8.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"lasso","fixed_in":["2.6.1-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lasso","fixed_in":["2.6.1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lasso","fixed_in":["2.6.1-3"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"lasso","fixed_in":["2.5.0-5+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"lasso","fixed_in":["2.6.0-2+deb10u1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"lasso","fixed_in":["0:2.5.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"lasso-debuginfo","fixed_in":["0:2.5.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"lasso-python","fixed_in":["0:2.5.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"lasso-devel","fixed_in":["0:2.5.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lasso","fixed_in":["0:2.5.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lasso-debuginfo","fixed_in":["0:2.5.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lasso-devel","fixed_in":["0:2.5.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lasso-python","fixed_in":["0:2.5.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-lasso-debuginfo","fixed_in":["0:2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lasso","fixed_in":["0:2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lasso-debuginfo","fixed_in":["0:2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lasso-debugsource","fixed_in":["0:2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-lasso-debuginfo","fixed_in":["0:2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-lasso-debuginfo","fixed_in":["0:2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-lasso-debuginfo","fixed_in":["0:2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lasso-debuginfo","fixed_in":["0:2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lasso-debugsource","fixed_in":["0:2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lasso-devel","fixed_in":["0:2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-lasso-debuginfo","fixed_in":["0:2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-lasso-debuginfo","fixed_in":["0:2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"lasso","fixed_in":["0:2.6.0-12.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"lasso","fixed_in":["2.6.1-8.7.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"lasso","fixed_in":["2.6.1-8.7.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"lasso","fixed_in":["2.6.1-8.7.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"lasso","fixed_in":["2.5.1-0ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"lasso","fixed_in":["2.6.0-7ubuntu1.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"lasso","fixed_in":["2.6.1-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"lasso","fixed_in":["2.7.0-2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"lasso-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-3"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-5+deb9u1"}]}],"versions":["2.5.0-5"]},{"source":"osv","ecosystem":"Debian:10","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-2+deb10u1"}]}],"versions":["2.6.0-2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"lasso-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"lasso-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"lasso-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lasso-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lasso-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"lasso-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-lasso-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lasso-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lasso-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-lasso-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-lasso-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"java-lasso-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lasso-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lasso-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lasso-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-lasso-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-lasso-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-12.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-8.7.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-8.7.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-8.7.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1-1build1","2.5.0-1","2.5.0-2","2.5.0-3","2.5.0-3build1","2.5.0-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-0ubuntu1.2"}]}],"versions":["2.5.0-5build4","2.5.0-5build5","2.5.0-5ubuntu1","2.5.1-0ubuntu1","2.5.1-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-7ubuntu1.2"}]}],"versions":["2.6.0-2ubuntu1","2.6.0-2ubuntu2","2.6.0-7ubuntu1","2.6.0-7ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-0ubuntu1.2"}]}],"versions":["2.5.0-5build4","2.5.0-5build5","2.5.0-5ubuntu1","2.5.1-0ubuntu1","2.5.1-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-7ubuntu1.2"}]}],"versions":["2.6.0-2ubuntu1","2.6.0-2ubuntu2","2.6.0-7ubuntu1","2.6.0-7ubuntu1.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lasso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-2.2"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"entrouvert","product":"lasso"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"http://listes.entrouvert.com/arc/lasso/","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://git.entrouvert.org/lasso.git/commit/?id=076a37d7f0eb74001127481da2d355683693cde9","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://git.entrouvert.org/lasso.git/tree/NEWS?id=v2.7.0","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4926","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00013.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SI4YAQF4VEV2KHQ6OXXZL7CJK7IZQ3EG/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSVWOHBBWLI2RB5C6TXINFEJRT4YSD3D/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28091","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SI4YAQF4VEV2KHQ6OXXZL7CJK7IZQ3EG/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YSVWOHBBWLI2RB5C6TXINFEJRT4YSD3D/"},{"url":"https://github.com/advisories/GHSA-5pxh-5p72-wvcm"},{"url":"https://errata.almalinux.org/8/ALSA-2021-4325.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-28091","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28091","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2989","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1940089","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2989.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28091","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28091","tags":["advisory","report"]},{"url":"https://blogs.akamai.com/2021/06/akamai-eaa-impersonation-vulnerability---a-deep-dive.html","tags":["article","report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4325","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1829785","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4325.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4325","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212589-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186768","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28091","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-28091","tags":["report"]},{"url":"https://git.entrouvert.org/lasso.git/commit/?id=ea7e5efe9741e1b1787a58af16cb15b40c23be5a","tags":["report"]},{"url":"https://blogs.akamai.com/2021/06/saml-implementation-vulnerability-impacting-some-akamai-services.html","tags":["report"]},{"url":"https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4974-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NVAZRUCJGDCHRY6W5ARRO5NRB27JQCR6/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-28091","description":"Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.","status":"published","published":"2021-06-04T14:39:14Z","modified":"2024-08-03T21:33:17.457Z","updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-14796","description":"Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.","status":"published","published":"2021-06-04T14:39:14Z","modified":"2024-08-03T21:33:17Z","updated_at":"2026-11-03T03:24:47.80549Z"}],"ghsa":[{"id":"GHSA-5pxh-5p72-wvcm","title":"Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.","description":"Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.","status":"published","published":"2022-05-24T19:04:06Z","modified":"2023-01-29T05:06:53Z","cwes":["CWE-347"],"updated_at":"2026-11-02T14:46:06.857512Z"}],"nvd":[{"id":"CVE-2021-28091","description":"Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.","status":"published","published":"2021-06-04T15:15:07.607Z","modified":"2026-06-17T03:45:47.833Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"AZL-7255","title":"CVE-2021-28091 affecting package lasso for versions less than 2.8.0-1","description":"Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.","status":"published","published":"2021-06-04T15:15:07Z","modified":"2026-04-21T04:36:45.806323Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2021-28091","description":"Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.","status":"published","published":"2021-06-04T15:15:07.607Z","modified":"2026-04-10T04:31:40.728412Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28091","description":"Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.","status":"published","published":"2021-06-04T15:15:07.607Z","modified":"2026-10-23T18:02:29.98563123Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"RHSA-2021:2989","title":"Red Hat Security Advisory: lasso security update","status":"published","published":"2024-09-16T06:02:10Z","modified":"2026-06-27T10:13:56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:4325","title":"Red Hat Security Advisory: lasso security and enhancement update","status":"published","published":"2024-09-16T06:02:18Z","modified":"2026-06-27T10:14:26Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4325","title":"Moderate: lasso security and enhancement update","description":"The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages.\n\nSecurity Fix(es):\n\n* lasso: XML signature wrapping vulnerability when parsing SAML responses (CVE-2021-28091)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:01:05Z","modified":"2026-02-05T11:30:03.600168Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-28091","description":"Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.","status":"published","published":"2021-06-01T12:00:00Z","modified":"2026-04-22T12:49:48.253514Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"ALSA-2021:4325","title":"Moderate: lasso security and enhancement update","description":"The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages.\n\nSecurity Fix(es):\n\n* lasso: XML signature wrapping vulnerability when parsing SAML responses (CVE-2021-28091)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:01:05Z","modified":"2026-10-29T11:01:01.816761913Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-2684-1","title":"lasso - security update","status":"published","published":"2021-06-10T00:00:00Z","modified":"2026-03-09T01:20:35.428054Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4926-1","title":"lasso - security update","status":"published","published":"2021-06-03T00:00:00Z","modified":"2026-03-09T02:10:40.465703Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2021:1057-1","title":"Security update for lasso","description":"This update for lasso fixes the following issues:\n\n- CVE-2021-28091: Fixed XML signature wrapping vulnerability when parsing SAML responses (boo#1186768)\n","status":"published","published":"2021-07-19T21:03:40Z","modified":"2026-02-04T03:18:16.193154Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10909-1","title":"liblasso-devel-2.7.0-2.2 on GA media","description":"These are all security issues fixed in the liblasso-devel-2.7.0-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:12:40.187612Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:2589-1","title":"Security update for lasso","description":"This update for lasso fixes the following issues:\n\n- CVE-2021-28091: Fixed XML signature wrapping vulnerability when parsing SAML responses. (bsc#1186768)\n","status":"published","published":"2021-08-02T10:51:57Z","modified":"2026-02-04T03:41:11.591283Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-4974-1","title":"lasso vulnerability","description":"It was discovered that Lasso did not properly verify that all\nassertions in a SAML response were properly signed. An attacker\ncould possibly use this to impersonate users or otherwise bypass\naccess controls.\n","status":"published","published":"2021-06-02T03:15:08Z","modified":"2026-04-27T18:44:25.812976Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}